A critical arbitrary code execution vulnerability in the openssl_encrypt Python package allows attackers to execute native code via malicious shared object files.

The package uses insecure glob patterns to load .so modules without integrity verification. An unauthenticated attacker can place a malicious .so file in site-packages directories to trigger native code execution when the Whirlpool hash implementation is invoked.

By placing malicious code in the search path, an attacker can achieve native code execution on the host system. This allows for total system compromise, including the theft of cryptographic keys and sensitive data processed by the library. The CVSS score of 9.8 highlights the critical danger of this supply chain style vulnerability.

Immediate Action: Update the jahlives openssl_encrypt package to version 1.4.0 or later via the appropriate package manager.

Proactive Monitoring: Monitor site-packages directories for the presence of unexpected or untrusted .so files that match the whirlpool naming pattern.

Compensating Controls: Use file integrity monitoring (FIM) on Python site-packages directories to detect unauthorized file creation.

Public Exploit Available: No confirmed public weaponized exploit is available at this time.

Users and maintainers of applications relying on jahlives openssl_encrypt must update to version 1.4.0 immediately. This vulnerability demonstrates the importance of verifying the integrity of loaded modules and maintaining strict control over library search paths.