CVE Vulnerability Catalog

NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled.

NLTK PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes.

openssl_encrypt before 1.4.9 fails to validate KDF cost parameters in encrypted file metadata and keystore headers, allowing attackers to trigger unbounded memory allocation. Attackers can craft malicious encrypted files declaring arbitrarily large Argon2, scrypt, or balloon KDF parameters to exhaust system memory and crash the process without authentication.

openssl_encrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The only default gate was an incomplete, bypassable AST denylist. If a user is induced to load an attacker's plugin, this results in arbitrary code execution with the privileges of the user running openssl_encrypt.

openssl_encrypt versions before 1.4.9 use under-parameterized PBKDF2-HMAC-SHA256 with only 100,000 iterations to protect PQC keyfile private keys and 10,000 iterations for dual-encryption file-password verification. Attackers who obtain keyfiles or encrypted files can brute-force wrapping passwords offline using GPU or ASIC acceleration.

openssl_encrypt versions up to 1.4.8 use suffix-tolerant fingerprint matching when binding a trust anchor. An operator confirming a short, forgeable GPG key id could unknowingly enroll an attacker's colliding key as trusted. Version 1.4.9 requires exact full primary-key fingerprint match.

openssl-encrypt before 1.4.9 fails to redact the file password in debug output when supplied via bundled short-option or abbreviated long-option spellings. The sanitizer only recognizes exact option names, --option=value forms, and tokens starting with -p, so these bypass redaction and the cleartext password is written to stderr. Anyone with access to that output can recover the password.

openssl_encrypt before 1.4.9 uses weak key derivation in D-Bus CryptoService.EncryptFile, using unstretched SHA-256 instead of Argon2id. Attackers can perform offline password guessing against encrypted files much faster than documented.

openssl_encrypt before 1.4.9 fails to validate key derivation function costs in crafted files, allowing attackers to trigger unbounded memory and CPU exhaustion during pre-authentication processing. Malicious files with excessive KDF parameters can crash or wedge the process.

openssl_encrypt before 1.4.9 contains a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name containing shell commands that execute when users copy the printed CLI block into a shell.

openssl_encrypt before 1.4.9 fails to validate the total field from QR JSON payloads before materializing ranges. Attackers can supply crafted QR images with extremely large total values to trigger unbounded memory allocation and cause denial of service through out-of-memory conditions.

openssl_encrypt versions 1.4.8 and earlier fail to validate the 36-bit STREAMINFO total_samples field of FLAC files before using it to size an allocation. A ~50-byte crafted FLAC file declaring ~100 million samples causes a multi-gigabyte memory allocation, leading to out-of-memory denial of service during 'decrypt --stego-extract'. Fixed in 1.4.9; both 1.4.x and 1.5.x lines are affected.

openssl_encrypt before 1.4.9 fails to validate server URLs in login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including client_id, passwords, and JWTs to achieve full keyserver account takeover.

openssl-encrypt before 1.4.9 contains a symlink-following flaw in its verify-usb v2 added-file allowlist scan. An evil-maid attacker with physical access to the removable drive could replace a tool-tree directory with a symlink to a copy containing byte-identical files plus a planted __pycache__/*.pyc file, which CPython loads in preference to recompiling the clean .py. The planted file is never enumerated, added_files stays 0, and verify-usb reports PASSED, resulting in code execution when the victim runs the portable install. Fixed in 1.4.9 (affects both 1.4.x and 1.5.x lines).

openssl_encrypt before 1.4.9 derives the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, allowing identical keys across all users and files. Attackers with access to wrapped pepper blobs can precompute a single dictionary table and perform fleet-wide offline password guessing at hardware speed to recover user passwords.

openssl_encrypt before version 1.4.9 stores an unkeyed SHA-256 hash of the plaintext in the cleartext file header. Attackers without the password can read this hash to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files.

openssl_encrypt (pip package openssl-encrypt) versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable (0644) SharedPreferences file. A local attacker with file system access can read the exposed private key. Version 1.4.9 writes the PEM to a dedicated 0600 file and scrubs existing cleartext values.

OpenRemote before version 1.28.0 contains a cross-realm information disclosure vulnerability in the Notification REST API. Tenant administrators can read all tenants' sent notifications including message bodies by submitting a zero-parameter GET request to the notification endpoint.

AVideo before version 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints.

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views are declared with a permission class that admits any caller, and the permission check does not halt execution. An unauthenticated request can receive rows and fields from the data source, and identifiers are small integers that can be enumerated. Version 2.3.1 passes raise_exception to the same call.