openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exit codes. Attackers holding compromised-then-revoked signing keys or expired project keys can bypass signature verification to execute malicious plugins in the host process.

openssl_encrypt versions prior to 1.4.9 contain a critical signature verification vulnerability in the gpg_runner.verify_detached function. The flaw arises from only checking the VALIDSIG status while ignoring REVKEYSIG, EXPKEYSIG statuses and GPG exit codes. This oversight allows attackers who possess revoked or expired signing keys to bypass signature verification entirely. Successful exploitation enables the execution of malicious plugins within the host process. The vulnerability poses a significant risk as it undermines the integrity of the plugin loading mechanism. Users are advised to upgrade to version 1.4.9 or later to remediate the issue.