GitHub Advisoryadvisory · PyPI

GHSA-47h8-jmp3-9f28 pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

HIGH Published 2024-12-19 Modified 2024-12-20 Official page ↗
Aliases
CVE-2024-56327
Ecosystem
PyPI
Packages
pyrage
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1395, CWE-25, CWE-94
Reviewed
2024-12-19

Affected packages

• PyPI pyrage: >= 1.2.0, < 1.2.3 → fixed in 1.2.3

Description

`pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore not affected. An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c. Thanks to ⬡-49016 for reporting this issue.

Related

Alias · CVE (1)

  • CVE-2024-56327 pyrage is a set of Python bindings for the rage file encryption library (age in Rust). vulnerability

Weakness · CWE (3)

  • CWE-1395 Dependency on Vulnerable Third-Party Component weakness
  • CWE-25 Path Traversal: '/../filedir' weakness
  • CWE-94 Improper Control of Generation of Code weakness

References