Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| jahlives | openssl_encrypt | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Mon, 17 Aug 2026 11:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | openssl_encrypt before 1.4.0 imports Python's non-cryptographic 'random' module (Mersenne Twister PRNG) at line 15 of openssl_encrypt/modules/pqc.py. No direct calls to random.* were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that future code could inadvertently use random.randint() instead of a cryptographically secure alternative (secrets/os.urandom), producing predictable values since the Mersenne Twister state can be recovered from approximately 624 outputs. Fixed by removing the import in 1.4.0. | |
| Title | openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module | |
| Weaknesses | CWE-338 | |
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-08-17T11:04:51.799Z
Reserved: 2026-08-17T10:42:40.455Z
Link: CVE-2026-74887
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-17T11:16:43.523
Modified: 2026-08-17T11:16:43.523
Link: CVE-2026-74887
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-17T13:00:13Z
-
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)