The openssl_encrypt library is susceptible to information disclosure via error messages, which may provide attackers with critical system details.

This issue is caused by the generation of error messages containing sensitive information (CWE-209). An unauthenticated attacker can trigger these errors to gain insights into the system's internal state or configuration.

Information disclosure vulnerabilities can provide attackers with the reconnaissance data necessary to craft more complex attacks. With a CVSS score of 7.5, the potential for unauthorized access to internal system details poses a significant risk to the overall security posture of the affected infrastructure.

Immediate Action: Update the jahlives openssl_encrypt package to version 1.4.0 or later to sanitize error handling and prevent sensitive data leakage.

Proactive Monitoring: Review application error logs for frequent, automated requests designed to force error states and capture verbose responses.

Compensating Controls: Configure application servers to display generic error pages to external users while logging detailed errors only to secure, internal-only files.

Public Exploit Available: false

To prevent unintended information leakage, organizations should apply the 1.4.0 update immediately. Restricting the verbosity of error responses is a critical step in hardening applications against unauthorized reconnaissance.