{"id":"CVE-2026-74879","aliases":["GHSA-2vhw-q7vh-7xv2"],"title":"openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers","summary":"openssl-encrypt's readiness endpoint leaks database error details to unauthenticated callers","severity":"medium","vendor":"openssl-encrypt","product":"openssl-encrypt","ecosystem":"pip","affected":["openssl-encrypt < 1.4.0"],"patched":["openssl-encrypt 1.4.0"],"published":"2026-04-01","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-2vhw-q7vh-7xv2","references":[{"url":"https://github.com/jahlives/openssl_encrypt/security/advisories/GHSA-2vhw-q7vh-7xv2"},{"url":"https://github.com/jahlives/openssl_encrypt/commit/7aa8787f4de2e9a23f58fca067bb16c4c69d28bb"},{"url":"https://github.com/jahlives/openssl_encrypt"}],"tags":["osv","pip"],"ingestedAt":"2026-08-18T12:28:08.023Z","epss":0.00259,"epssPercentile":0.17893,"slug":"CVE-2026-74879","body":"## Overview\n\n### Summary\n\nThe `/ready` endpoint in `openssl_encrypt_server/server.py` at **lines 159-175** catches database errors and returns the full exception string in the response.\n\n### Affected Code\n\n```python\nexcept Exception as e:\n    return {\"status\": \"not_ready\", \"reason\": str(e)}\n```\n\n### Impact\n\nDatabase exception messages can leak:\n- Database hostnames and IP addresses\n- Connection parameters and port numbers\n- Driver version information\n- Potentially database credentials if included in connection string errors\n\nThis information is available to unauthenticated callers.\n\n### Recommended Fix\n\n- Return a generic error message: `{\"status\": \"not_ready\", \"reason\": \"database unavailable\"}`\n- Log the full exception server-side for debugging\n\n### Fix\n\nFixed in commit `7aa8787` on branch `releases/1.4.x` — replaced str(e) with generic \"database check failed\" message; full exception logged server-side at WARNING level.\n\n## Affected packages\n\n- `openssl-encrypt < 1.4.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `openssl-encrypt 1.4.0`","depth":"sunlit","depthScore":28,"depthScoreParts":{"impact":27.5,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}