Description

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-08-27T17:21:01.590Z",
  "pubdate": "2026-08-27T17:21:01.590Z",
  "executiveSummary": "The openssl-encrypt package, in versions 1.4.8 and earlier, contains a critical security flaw in the enroll_trust_key function related to how GPG trust anchors are validated.\nThe vulnerability originates from suffix-tolerant fingerprint matching, which allows for the acceptance of short, collision-prone 32-bit GPG key IDs instead of requiring a complete primary-key fingerprint.\nThis flaw enables an attacker to perform a cryptographic impersonation attack, where a malicious key is registered as a trusted anchor through a forged collision.\nOnce the attacker's key is enrolled, the ENFORCE signature policy treats it as a legitimate authority for plugin signing, facilitating the deployment of malicious or backdoored plugins.\nThe risk is significant as it undermines the integrity of the plugin ecosystem, allowing for unauthorized code execution within the environment.\nExploitation requires an operator to inadvertently confirm a short GPG key ID that shares the same suffix as a legitimate key, effectively weaponizing the user's trust to bind a rogue credential.",
  "technicalDetails": "The root cause of this vulnerability lies in the logic implemented within the enroll_trust_key function, which erroneously utilizes suffix-tolerant matching when binding a plugin-signing trust anchor. By design, GPG key IDs are often displayed as short 32-bit identifiers, which are susceptible to collision attacks due to their limited entropy. By failing to validate the full primary-key fingerprint, the system accepts any key that matches the short suffix, regardless of whether the actual public key material belongs to the trusted party.\nThe attack flow proceeds as follows: First, the attacker generates a malicious GPG key that shares the same 32-bit suffix as a legitimate, trusted key. Second, the attacker induces the operator to initiate the enrollment of a trust anchor. When the operator is presented with or confirms the truncated key ID, they are unaware that the displayed identifier corresponds to the attacker's colliding key rather than the intended target. Third, the openssl-encrypt logic verifies the suffix match, considers the validation successful, and stores the malicious key in the trust store.\nUpon successful binding, the attacker leverages the forged trust anchor to sign malicious plugins. Because the system is configured to use the ENFORCE signature policy, the runtime environment validates these signed plugins against the compromised trust store. The signature validation process interprets the attacker's key as a legitimate authority, successfully verifying the signatures of unauthorized or malicious code. Consequently, the application proceeds to load and execute the compromised plugins, leading to potential arbitrary code execution or privilege escalation within the context of the host application.\nThe vulnerability affects versions 1.4.8 and below. The remediation implemented in version 1.4.9 enforces a strict validation policy requiring the confirmed value to exactly match the full primary-key fingerprint, while also ensuring the input process is robust against case-sensitivity and whitespace discrepancies. This move from suffix-based matching to full-length cryptographic fingerprint verification eliminates the collision vector previously available to attackers."
}