The jahlives openssl_encrypt package versions 1.4.8 and earlier contain a critical vulnerability that exposes mTLS client private keys to local attackers, risking unauthorized system access.

This vulnerability is a cleartext storage of sensitive information (CWE-312) where the desktop GUI saves PEM-encoded private keys in a world-readable (0644) file. The flaw is accessible to any local user on the host system without requiring special authentication or privileges.

The compromise of an mTLS private key allows an attacker to masquerade as a legitimate client, potentially leading to unauthorized access to secured services and sensitive data. With a CVSS score of 8.4, this vulnerability represents a high risk to organizational security, as it facilitates complete bypass of authentication mechanisms relying on mTLS.

Immediate Action: Upgrade the openssl_encrypt package to version 1.4.9 or later, which migrates existing cleartext keys to a secure file with restricted (0600) permissions.

Proactive Monitoring: Review file system permissions for configuration directories and monitor for unauthorized access attempts to the application's SharedPreferences or data directories.

Compensating Controls: If immediate patching is not possible, manually restrict read access to the affected SharedPreferences file at the operating system level or rotate all mTLS credentials currently stored by the application.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability, administrators should prioritize updating to version 1.4.9 immediately to ensure credentials are properly scrubbed and migrated to secure storage. Failure to remediate this issue leaves the host system and any services relying on these mTLS keys vulnerable to impersonation attacks.