GHSA-j48q-4c78-rhf9 openssl-encrypt: Dynamic .so loading for Whirlpool uses broad glob pattern without integrity verification

• PyPI openssl-encrypt: < 1.4.0 → fixed in 1.4.0

Severity: HIGH Summary The Whirlpool hash implementation in `openssl_encrypt/modules/registry/hash_registry.py` at lines 570-589 uses glob patterns to find `.so` modules in site-packages and loads the first match via `importlib` without verifying module integrity. Affected Code ```python for site_pkg in site.getsitepackages(): pattern = os.path.join(site_pkg, "whirlpool*py313*.so") py313_modules = glob.glob(pattern) if py313_modules: module_path = py313_modules[0] # Takes first match loader = ExtensionFileLoader("whirlpool", module_path) spec = importlib.util.spec_from_file_location("whirlpool", module_path, loader=loader) whirlpool_module = importlib.util.module_from_spec(spec) spec.loader.exec_module(whirlpool_module) ``` Impact The glob pattern `"whirlpool*py313*.so"` is broad and takes the first match without verifying: • File hash/signature • File ownership/permissions • Whether it's a legitimate module If an attacker can place a malicious `.so` file matching this pattern in any site-packages directory, it will be loaded and native code executed. Recommended Fix • Verify the module's integrity (hash or signature) before loading • Use a specific filename rather than a glob pattern • Check file permissions and ownership Fix Fixed in commit `963d0d1` on branch `releases/1.4.x` — added os.path.realpath() to resolve symlinks and validation that found .so files are within known site-packages directories before loading.