Executive brief
openssl_encrypt is a library that verifies cryptographic signatures on plugins and package manifests before execution. A flaw in the signature verification logic allows attackers with revoked or expired signing keys to bypass verification and execute malicious code in the host process, potentially compromising systems that rely on this library for secure plugin loading.
Technical details
The vulnerability is an improper cryptographic signature verification (CWE-347) in the gpg_runner.verify_detached function. The root cause is insufficient inspection of GnuPG status output: the code checks only for VALIDSIG/GOODSIG without examining REVKEYSIG, EXPKEYSIG, EXPSIG, or the gpg exit code. This allows cryptographically valid signatures made with revoked or expired keys to be accepted. Additionally, the fingerprint validation compared the subkey fingerprint rather than the primary key fingerprint. The attack requires the attacker to possess a signing key that was previously valid and is now revoked or expired. Exploitation results in arbitrary code execution in the host process. The fix in version 1.4.9 requires both GOODSIG and VALIDSIG, treats revocation/expiration status flags as failures, checks the gpg exit code, and compares the primary-key fingerprint.
Affected products
- jahlives openssl_encrypt before 1.4.9
Timeline
- 2026-08-12: disclosed
- 2026-08-12: patched: Version 1.4.9 released with fix
- 2026-08-27: advisory