p PatchFirst

CVE-2024-56327

CVE-2024-56327 · Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage

This page contains facts from public vulnerability sources. Check the original advisory before updating.

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.

CVSS 7.7 · High · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • pyrage

    Versions
    • >= 1.2.0, < 1.2.3: Affected

    No fix published

  • pyrage PyPI

    Versions
    • 1.2.1
    • 1.2.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.2.0, < 1.2.3

    Update to 1.2.3

  • age Ubuntu:Pro:24.04:LTS

    Versions
    • 1.1.1-1build1
    • 1.1.1-1ubuntu0.24.04.1
    • 1.1.1-1ubuntu0.24.04.2
    • 1.1.1-1ubuntu0.24.04.3
    Affected ranges
    • ECOSYSTEM: < 1.1.1-1ubuntu0.24.04.3+esm1

    Update to 1.1.1-1ubuntu0.24.04.3+esm1

Original sources

Check your server →