Hidden-data disclosure via predictable pixel selection

Information disclosure in OpenSSL Encrypt before 1.4.0 allows attackers to read hidden steganographic data via predictable pixel selection. The generate_pseudorandom_sequence() function in openssl_encrypt/plugins/steganography/core/utils.py seeds Python's Mersenne Twister with only 64 bits from a SHA-256 password hash and uses random.sample() to choose embedding locations, making those locations reproducible instead of cryptographically unpredictable. Exploitation requires knowledge or a successful guess of the steganography password plus enough recovered outputs to reconstruct PRNG state; the demonstrated consequence is hidden-data extraction rather than modification or code execution.