UBUNTU-CVE-2024-56327

See a problem?
Please try reporting it to the source first.
Source
https://ubuntu.com/security/CVE-2024-56327
Import Source
https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-56327.json
JSON Data
https://api.osv.dev/v1/vulns/UBUNTU-CVE-2024-56327
Upstream
Downstream
Related
Published
2024-12-19T23:15:00Z
Modified
2026-06-02T18:16:11Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
  • 7.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
  • Ubuntu - medium
Summary
[none]
Details

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). pyrage uses the Rust age crate for its underlying operations, and age is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to pyrage for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of pyrage before 1.2.0 lack plugin support and are therefore not affected. An equivalent issue was fixed in the reference Go implementation of age, see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.

References

Affected packages

Ubuntu:Pro:24.04:LTS / age

Package

Name
age
Purl
pkg:deb/ubuntu/age?arch=source&distro=esm-apps%2Fnoble

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
1.1.1-1ubuntu0.24.04.3+esm1

Affected versions

1.*
1.1.1-1build1
1.1.1-1ubuntu0.24.04.1
1.1.1-1ubuntu0.24.04.2
1.1.1-1ubuntu0.24.04.3

Ecosystem specific 

{
    "availability": "Available with Ubuntu Pro: https://ubuntu.com/pro",
    "binaries": [
        {
            "binary_name": "age",
            "binary_version": "1.1.1-1ubuntu0.24.04.3+esm1"
        },
        {
            "binary_name": "golang-filippo-age-dev",
            "binary_version": "1.1.1-1ubuntu0.24.04.3+esm1"
        }
    ]
}

Database specific

source 
"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2024/UBUNTU-CVE-2024-56327.json"