VDB
GHSA-4fg7-vxc8-qx5w
GHSA-4fg7-vxc8-qx5w
PUBLISHED
rage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| chainguard | rye | 0 |
| crates.io | rage | 0.11.0, 0.6.0, 0.6.0 |
| wolfi | rye | 0 |
| crates.io | age | 0.6.0, 0.6.0, 0.7.0 |
Timeline
- Dec 18, 2024 CVE Published
- Jan 3, 2025 CVE Updated
References
- https://github.com/advisories/GHSA-4fg7-vxc8-qx5w advisory
- https://github.com/str4d/rage/security/advisories/GHSA-4fg7-vxc8-qx5w url
- https://github.com/str4d/rage/commit/703152ecfa86f27952a35b57dd525ed39396a227 patch
- https://github.com/str4d/rage url
- https://rustsec.org/advisories/RUSTSEC-2024-0432.html url
- https://rustsec.org/advisories/RUSTSEC-2024-0433.html url