pyrage
uses the Rust age
crate for its underlying operations, and age
is vulnerable to GHSA-4fg7-vxc8-qx5w.
All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage
for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details.
Versions of pyrage
before 1.2.0 lack plugin support and are therefore not affected.
An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c.
Thanks to ⬡-49016 for reporting this issue.
{ "nvd_published_at": "2024-12-19T23:15:07Z", "cwe_ids": [ "CWE-1395", "CWE-25", "CWE-94" ], "severity": "HIGH", "github_reviewed": true, "github_reviewed_at": "2024-12-19T15:14:06Z" }