A critical signature verification flaw in jahlives openssl_encrypt allows unauthenticated attackers to bypass security checks and execute arbitrary code via malicious plugins.

The vulnerability resides in the gpg_runner.verify_detached function, which improperly verifies cryptographic signatures (CWE-347) by failing to check for revoked or expired keys. An unauthenticated attacker can leverage compromised signing keys to bypass verification logic and execute malicious plugins within the host process.

This vulnerability carries a CVSS score of 9.8, indicating a critical severity level due to the potential for total system compromise. Successful exploitation allows an attacker to achieve remote code execution in the context of the host process, potentially leading to unauthorized data access, full system control, and significant reputational damage.

Immediate Action: Update jahlives openssl_encrypt to version 1.4.9 or later immediately to incorporate the necessary signature validation logic.

Proactive Monitoring: Review system and application logs for unexpected plugin loading events or unusual cryptographic verification errors that may indicate an exploitation attempt.

Compensating Controls: While no direct virtual patch exists, ensure that GPG key management practices are strictly enforced and that only trusted, non-revoked keys are permitted within the environment until the update is applied.

Public Exploit Available: No (exploit_available: false)

Given the critical CVSS severity and the potential for remote code execution, this vulnerability poses a severe threat to organizational security. Administrators must prioritize the deployment of the 1.4.9 update across all affected environments immediately to eliminate the risk of signature bypass and unauthorized plugin execution.