—

PYSEC-2026-3962

Quick fix

PYSEC-2026-3962 — openssl-encrypt: upgrade to the fixed version with the command below.

pip install --upgrade 'openssl-encrypt>=1.4.9'

Details

openssl_encrypt before 1.4.9 fails to re-derive and validate fingerprints when loading identities from identity.json, allowing attackers to substitute public keys in identity stores. Attackers can replace legitimate public keys with their own while maintaining the claimed fingerprint, enabling silent key substitution where encryption uses attacker keys and signature verification appears valid.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/openssl-encrypt

Introduced in: 0Fixed in: 1.4.9

Fixpip install --upgrade 'openssl-encrypt>=1.4.9'

References

https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-q8p3-7h6h-ghfr[ADVISORY]
https://www.vulncheck.com/advisories/openssl-encrypt-before-1.4.9-key-substitution-via-identity-load[ADVISORY]