CyberRota Analysis
AI-GeneratedOpenSSL versions prior to 1.4.9 are vulnerable to a critical signature verification flaw that allows attackers to exploit revoked or expired keys, as the system fails to adequately check for key validity. This vulnerability can lead to the execution of malicious plugins within the host process, posing a significant risk to system integrity. Organizations using affected versions of OpenSSL should prioritize immediate updates to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.
Related CVEs
Other vulnerabilities affecting the same vendor(s)