The openssl_encrypt library is vulnerable to weak random number generation, which poses a significant risk to the integrity of cryptographic operations.

This vulnerability involves the use of a cryptographically weak pseudo-random number generator (CWE-338). The flaw is remotely exploitable by an unauthenticated attacker, as indicated by the CVSS vector.

Successful exploitation allows an attacker to predict generated values, potentially leading to the compromise of encrypted data or the bypass of security mechanisms. Given the CVSS score of 7.5, this high-severity vulnerability could lead to significant data exposure and loss of confidentiality for sensitive business communications or stored information.

Immediate Action: Update the jahlives openssl_encrypt package to version 1.4.0 or later to implement a secure random number generator.

Proactive Monitoring: Monitor application logs for unusual patterns in cryptographic output or repeated failures in encrypted handshake processes.

Compensating Controls: Ensure that systems relying on this library are isolated within secure network segments to limit exposure to potential attackers.

Public Exploit Available: false

This vulnerability presents a clear risk to data confidentiality. IT administrators must prioritize updating to version 1.4.0 immediately to replace the weak random number generator with a secure implementation.