CyberRota Analysis
AI-GeneratedOpenSSL versions up to 1.4.8 are vulnerable due to a flaw in the `openssl_encrypt` function, which allows an attacker to exploit suffix-tolerant fingerprint matching. This can lead to the enrollment of a malicious key as a trusted anchor, enabling the execution of harmful plugins under the ENFORCE signature policy. Organizations using affected versions should prioritize upgrading to version 1.4.9 or later to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
Related CVEs
Other vulnerabilities affecting the same vendor(s)