https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T07:26:44.608760+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-380490 EUVD-2026-380490 2026-10-04T07:26:44.678992+00:00 EUVD-2026-380490 https://cve.radiocsirt.org/vuln/fkie_cve-2026-81714 fkie_cve-2026-81714 2026-10-04T07:26:44.679029+00:00

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).

 https://cve.radiocsirt.org/vuln/ghsa-xrf2-fg77-9588 GHSA-xrf2-fg77-9588 2026-10-04T07:26:44.679067+00:00

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).

 https://cve.radiocsirt.org/vuln/pysec-2026-3799 PYSEC-2026-3799 2026-10-04T07:26:44.679087+00:00

Affected: PyPI: openssl-encrypt

openssl_encrypt (pip: openssl-encrypt) versions <= 1.4.8 use suffix-tolerant fingerprint matching in enroll_trust_key when binding a plugin-signing trust anchor. An operator who confirms a short (forgeable, ~32-bit) GPG key id could unknowingly enroll an attacker's colliding key as a trusted anchor, which then vouches for malicious plugins under the ENFORCE signature policy. Version 1.4.9 fixes this by requiring the confirmed value to exactly match the full primary-key fingerprint (case-insensitive, whitespace-stripped).