CVE-2024-56327

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Dec 19, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-563286.1Discourse is an open source platform for community discussion. An attacker can execute arbitrary JavaScript on users' browsers by posting a CVE-2024-563298.9Socialstream is a third-party package for Laravel Jetstream. It replaces the published authentication and profile scaffolding provided by La CVE-2024-56337.5Longse model LBH30FE200W cameras, as well as products based on this device, provide an unrestricted access for an attacker located in the sa CVE-2024-563309.3Stardust is a platform for streaming isolated desktop containers. With this exploit, inter container communication (ICC) is not disabled. Th CVE-2024-563316.8Uptime Kuma is an open source, self-hosted monitoring tool. An **Improper URL Handling Vulnerability** allows an attacker to access sensitiv CVE-2024-563325.3Next.js is a React framework for building full-stack web applications. Starting in version 13.0.0 and prior to versions 13.5.8, 14.2.21, and CVE-2024-563339.4Onyxia is a web app that aims at being the glue between multiple open source backend technologies to provide a state of art working environm CVE-2024-563347.8systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are pass CVE-2024-563357.5vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. In affected versions an attacker i CVE-2024-563369.8A vulnerability has been identified in SINAMICS S200 (All versions with serial number beginning with SZVS8, SZVS9, SZVS0 or SZVSN and the FS CVE-2024-563379.8Time-of-check Time-of-use (TOCTOU) Race Condition vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through CVE-2024-563384.8IBM Sterling B2B Integrator Standard Edition 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 is vulnerable to cross-site scripting. This