CVE-2024-56327CWE-94

Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage

High Β· published December 19, 2024

CVSS v4.0
7.7
EPSS
0%
Percentile
41.9
In the wild
Unconfirmed
What it is

⚑ A sneaky vulnerability lurks in `pyrage`, and it’s tied to the Rust `age` library β€” a recipe for potential file encryption disasters! πŸ”’ Think of `pyrage` as a vault that relies on a secure lock, but this lock has been found to be a bit wobbly. If someone had access, they could slip in a fake key and potentially get through the vault door without breaking a sweat! An attacker could exploit this vulnerability to access encrypted files or manipulate sensitive data, leading to unauthorized disclosure of information β€” absolutely devastating for any security-conscious user. Imagine someone reading your private diary when you thought it was locked away safe!

Put simply

Think of `pyrage` as a vault that relies on a secure lock, but this lock has been found to be a bit wobbly. If someone had access, they could slip in a fake key and potentially get through the vault door without breaking a sweat! This vulnerability arises from a flaw in the underlying Rust `age` crate that `pyrage` uses, making it possible for attackers to compromise the integrity of file encryption. Versions prior to 1.2.0 are not affected, but those using 1.2.0 to 1.2.2 need to be cautious!

What to do

An attacker could exploit this vulnerability to access encrypted files or manipulate sensitive data, leading to unauthorized disclosure of information β€” absolutely devastating for any security-conscious user. Imagine someone reading your private diary when you thought it was locked away safe! Update `pyrage` to version 1.2.3 immediately to close this security gap. Since no workarounds exist, applying the fix is crucial for maintaining the security of your encrypted files. Don't let that vault remain vulnerable! You've got this! With a quick update, your encryption will be back on lock πŸ”’ and your data safe again. πŸ›‘οΈ

The record
Technical detail
CVSS v4.0
7.7 Β· HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00499 Β· 41.9th percentile
Weakness
CWE-94 Β· Improper Control of Generation of Code ('Code Injection')
Published
2024-12-19T22:24Z
EPSS history
Timeline
  • 19 DEC 22:24Z
    Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage
    cvelistv5