CVE-2024-56327 Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyrage
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2024-56327?
CVE-2024-56327 is a high-severity vulnerability in woodruffw pyrage, published on 19 Dec 2024.
Official description
pyrage is a set of Python bindings for the rage file encryption library (age in Rust). `pyrage` uses the Rust `age` crate for its underlying operations, and `age` is vulnerable to GHSA-4fg7-vxc8-qx5w. All details of GHSA-4fg7-vxc8-qx5w are relevant to `pyrage` for the versions specified in this advisory. See GHSA-4fg7-vxc8-qx5w for full details. Versions of `pyrage` before 1.2.0 lack plugin support and are therefore **not affected**. An equivalent issue was fixed in [the reference Go implementation of age](https://github.com/FiloSottile/age), see advisory GHSA-32gq-x56h-299c. This issue has been addressed in version 1.2.3 and all users are advised to update. There are no known workarounds for this vulnerability.
Weakness: CWE-94
Which versions are affected by CVE-2024-56327?
32 open source packages ship an affected version, including pyrage, filippo.io/age and age.
| Package | Affected | Fixed in |
|---|---|---|
pyrage PyPI | From 1.2.0 | 1.2.3 |
pyrage PyPI | From 1.2.0 | 1.2.3 |
pyrage PyPI | From 1.2.0 | 1.2.3 |
filippo.io/age Go | All versions | 1.2.1 |
filippo.io/age Go | All versions | 1.2.1 |
filippo.io/age Go | All versions | 1.2.1 |
26 more packages
age crates.io | From 0.10.0 | 0.10.1 |
age crates.io | From 0.10.0 | 0.10.1 |
age crates.io | From 0.11.0 | 0.11.1 |
age crates.io | From 0.11.0 | 0.11.1 |
age crates.io | From 0.6.0 | 0.6.1, 0.7.2, 0.8.2, 0.9.3, 0.10.1, 0.11.1 |
age crates.io | From 0.6.0 | 0.6.1 |
age crates.io | From 0.6.0 | 0.6.1 |
age crates.io | From 0.7.0 | 0.7.2 |
age crates.io | From 0.7.0 | 0.7.2 |
age crates.io | From 0.8.0 | 0.8.2 |
age crates.io | From 0.8.0 | 0.8.2 |
age crates.io | From 0.9.0 | 0.9.3 |
age crates.io | From 0.9.0 | 0.9.3 |
rage crates.io | From 0.10.0 | 0.10.1 |
rage crates.io | From 0.10.0 | 0.10.1 |
rage crates.io | From 0.11.0 | 0.11.1 |
rage crates.io | From 0.11.0 | 0.11.1 |
rage crates.io | From 0.6.0 | 0.6.1, 0.7.2, 0.8.2, 0.9.3, 0.10.1, 0.11.1 |
rage crates.io | From 0.6.0 | 0.6.1 |
rage crates.io | From 0.6.0 | 0.6.1 |
rage crates.io | From 0.7.0 | 0.7.2 |
rage crates.io | From 0.7.0 | 0.7.2 |
rage crates.io | From 0.8.0 | 0.8.2 |
rage crates.io | From 0.8.0 | 0.8.2 |
rage crates.io | From 0.9.0 | 0.9.3 |
rage crates.io | From 0.9.0 | 0.9.3 |
How do I fix CVE-2024-56327?
Upgrade pyrage to 1.2.3 or later.
Is CVE-2024-56327 being exploited?
There is no known exploitation of CVE-2024-56327 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2025-CS89495, GHSA-32gq-x56h-299c, GHSA-47h8-jmp3-9f28, GHSA-4fg7-vxc8-qx5w, GO-2024-3344, MINI-cj3v-chmh-r24v and 6 more.