Progress OpenEdge OECHE1 Weakness Leads to Credential Leakage (CVE-2025-8001)

OpenEdge OECHE1 Password/Key Protection Vulnerability Summary Vulnerability Overview Vulnerability ID: 000298643 CVE ID: CVE-2025-8001 Vulnerability Name: Unintended Use of OECHE1 for Password/Secrets Protection Release Date: April 14, 2025 Severity: Critical Security Vulnerability Issue Description: The OECHE1 encoding algorithm used by OpenEdge has serious weaknesses. Historically used to obfuscate sensitive configuration values, it has been determined to be cryptographically weak and unreliable. Attackers can easily crack OECHE1-encoded values, leading to leakage of sensitive data such as passwords and keys. Impact Scope Affected Versions: - OpenEdge 12.2.18 and earlier - OpenEdge 12.8.9 and earlier Affected Components: - All OpenEdge versions (including maintenance releases) - All platform-managed and customer-managed OECHE1-encoded values Specific Impacts: - Administrator passwords stored in configuration or .pff files - Database administrator passwords used to bootstrap ABL connections - OpenEdge Management (OEM) administrator credentials - Domain Access Control (DAC) for ABL clients and utilities - TLS/SSL keystore alias credentials - OEAG authentication keys and passwords - Encoded passwords or audit keys (e.g., ABL method ENCRYPT-AUDIT-MAC-KEY()) - Command-line utilities (e.g., gpassword) Remediation Plan Emergency Measures 1. Upgrade OpenEdge: Upgrade to the following versions: - OpenEdge 12.2.19 (fixes issues in OpenEdge 12.2.18 and earlier) - OpenEdge 12.8.11 (fixes issues in OpenEdge 12.8.9 and earlier) 2. Migrate OECHE1-Encoded Values: - All customer-managed OECHE1-encoded values must be changed before production deployment - Replace OECHE1-encoded values with stronger encoding algorithms - Migration activities must be carefully planned to ensure business continuity Migration Steps 1. Identify: Identify all customer-managed OECHE1-encoded values 2. Replace: Replace affected credentials with new encodings using stronger obfuscation algorithms 3. Verify: Verify configuration files and .pff files for system startup 4. Test: Test all execution paths to ensure no OECHE1 upgrades are detected Temporary Migration Support For many OECHE1 use cases, downgrading is not possible without impacting OpenEdge updates Development-time migration options are provided, allowing incremental remediation of existing OECHE1-encoded values in development environments Important Limitations: - Existing OECHE1 values can be decoded, but new OECHE1 values cannot be generated - No support for existing OECHE1-encoded values - This mode is strongly discouraged for production environments - Intended only for development and migration testing Notes After upgrading, any value encoded with OECHE1 will cause a runtime error and may prevent OpenEdge components from running OECHE1 is no longer allowed at runtime All OpenEdge components will raise an error upon encountering OECHE1-encoded values Ensure that all platform-managed and customer-managed OECHE1 values are replaced with stronger encoding algorithms User accounts managed by OpenEdge (_USER) are not affected by OECHE1

Goal Reached Thanks to every supporter — we hit 100%!

Progress OpenEdge OECHE1 Weakness Leads to Credential Leakage (CVE-2025-8001)