Security Digest · Critical advisory (no CVE assigned)
GHSA-h45m-mgcp-q388: openssl-encrypt: TOTP rate limiter is in-memory only — not shared across workers, lost on restart
Severity: HIGH Summary The TOTP brute-force rate limiter in opensslencryptserver/modules/pepper/totp.py at lines 47-98 uses an in-memory defaultdict(list) as a class variable.
CVSS 9.1 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
pip-audit (or: pip show <package>). - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| PyPI | openssl-encrypt | < 1.4.0 | 1.4.0 |
Details
Severity: HIGH
Summary
The TOTP brute-force rate limiter in opensslencryptserver/modules/pepper/totp.py at lines 47-98 uses an in-memory defaultdict(list) as a class variable.
Affected Code
Impact
1. Rate limit state is not shared across multiple server instances/workers — an attacker can distribute attempts 2. All rate limit state is lost on server restart — allows immediate retry 3. In multi-worker deployments, each worker has independent rate limit state
Recommended Fix
- Use Redis or the database for rate limit state storage - Or use a shared-memory approach for multi-worker deployments - At minimum, persist lockout state to survive restarts
CVSS: 9.1 (v4.0) CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Sources and references
- GitHub Advisory GHSA-h45m-mgcp-q388 github.com
- github.com github.com
- github.com github.com