Description

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-27T17:21:00.367Z",
  "pubdate": "2026-08-27T17:21:00.367Z",
  "executiveSummary": "The openssl_encrypt package, specifically in versions prior to 1.4.9, contains a critical signature verification flaw within the gpg_runner.verify_detached function. This vulnerability allows the bypass of security controls intended to validate GPG signatures, enabling the acceptance of revoked or expired cryptographic keys. The defect originates from an incomplete validation logic that relies exclusively on the VALIDSIG status reported by GPG, while failing to check for explicit REVKEYSIG or EXPKEYSIG flags, nor verifying the exit status of the GPG process itself.\nThe risk implication is high, as an attacker in possession of a compromised or expired signing key can masquerade as a legitimate source. Successful exploitation permits the execution of malicious plugins within the host process, potentially leading to unauthorized code execution and full system compromise. The vulnerability is exploitable by any actor capable of providing a signature file that utilizes a known compromised or expired key. There are no authentication requirements for this exploit, as the vulnerability exists within the validation routine of the package itself, exposing the host to tainted plugin injections.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of the GPG signature verification routine within the gpg_runner.verify_detached function. When validating a detached signature, the package invokes the GPG utility and parses the resulting output stream. The current logic is designed to search for the VALIDSIG status notification in the output, which GPG emits when a signature is cryptographically valid against a key available in the keyring. However, this implementation is insufficient because it treats a cryptographically valid signature as a trusted signature regardless of the key's lifecycle state.\nThe function fails to account for critical GPG status indicators such as REVKEYSIG (which signals that the key used for the signature has been revoked) and EXPKEYSIG (which signals that the key has expired). Furthermore, the function does not validate the exit code of the GPG process, which is a fundamental requirement for confirming that the verification process completed successfully without internal errors or policy violations. By ignoring these indicators, the function grants authority to signatures generated by keys that should no longer be trusted.\nThe attack flow proceeds as follows: First, an attacker identifies a target that utilizes openssl_encrypt versions below 1.4.9 for plugin verification. The attacker obtains or creates a signature file using a key that was previously legitimate but has since been revoked or allowed to expire. Because the target system performs an incomplete check, it ignores the expiration or revocation metadata and focuses solely on the mathematical validity of the signature. When the host process calls gpg_runner.verify_detached to verify the malicious plugin's signature, the function erroneously returns a success state. Consequently, the host application proceeds to load and execute the malicious plugin code within its own process space.\nThe impact of this exploitation is severe, as it bypasses the primary trust mechanism of the plugin loading system. An attacker with access to an expired or revoked key can achieve arbitrary code execution on the host machine. Given that plugins often operate with the privileges of the host process, this can result in lateral movement, data exfiltration, or persistence within the environment. The flaw is not limited by network exposure, as it depends on the processing of the signature file, which may occur as part of a local build process, automated deployment, or user-supplied file ingestion."
}