Skip to content

Malicious plugin names, recipients, or identities can cause arbitrary binary execution

Moderate
woodruffw published GHSA-47h8-jmp3-9f28 Dec 19, 2024

Package

pip pyrage (pip)

Affected versions

1.2.0, 1.2.1, 1.2.2

Patched versions

1.2.3

Description

pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w.

All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.

Versions of pyrage before 1.2.0 lack plugin support and are therefore not affected.

An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.

Thanks to ⬡-49016 for reporting this issue.

Severity

Moderate

CVE ID

CVE-2024-56327

Weaknesses

Path Traversal: '/../filedir'

The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /../ sequences that can resolve to a location that is outside of that directory. Learn more on MITRE.

Credits