openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers
Summary
The /ready endpoint in openssl_encrypt_server/server.py at lines 159-175 catches database errors and returns the full exception string in the response.
Affected Code
except Exception as e:
return {"status": "not_ready", "reason": str(e)}Impact
Database exception messages can leak:
- Database hostnames and IP addresses
- Connection parameters and port numbers
- Driver version information
- Potentially database credentials if included in connection string errors
This information is available to unauthenticated callers.
Recommended Fix
- Return a generic error message:
{"status": "not_ready", "reason": "database unavailable"} - Log the full exception server-side for debugging
Fix
Fixed in commit 7aa8787 on branch releases/1.4.x — replaced str(e) with generic "database check failed" message; full exception logged server-side at WARNING level.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | openssl-encrypt | < 1.4.0 | 1.4.0 |
References
- https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2
- https://www.vulncheck.com/advisories/openssl-encrypt-before-information-disclosure-via-ready-endpoint
- https://github.com/jahlives/openssl_encrypt/commit/7aa8787f4de2e9a23f58fca067bb16c4c69d28bb
- https://github.com/jahlives/openssl_encrypt
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U- Weakness (CWE)
CWE-201- Platform
- Python (PyPI)
- Package
openssl-encrypt- Disclosed
- 01.04.2026
- Updated
- 11.10.2026 15:17
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2026-3758 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-2vhw-q7vh-7xv2 - CC BY 4.0
Vulnerability history: openssl-encrypt
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 60
- First → latest
- 03.2026 08.2026
- Without a fix
- 0
- Exploited in attacks
- 0
Severity breakdown
- Critical 2
- High 1
- Medium 15
- Unrated 42
Disclosures per year
- 2026: 60
-
openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.