Em resumo
- CVE-2026-81714 é uma vulnerabilidade ALTO (CVSS 7.0) que afeta openssl-encrypt, openssl encrypt (jahlives).
- Chance de exploração nos próximos 30 dias (EPSS): 0.20%, maior que 9.7% das vulnerabilidades.
- Correção: atualize para 1.4.9 ou posterior.
Description
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
NVD description
openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).
Mais vulnerabilidades de openssl-encrypt
Ver tudo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free