Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

filippo.io/age

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. UnratedGoPublished

    age vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution

    GHSA-32gq-x56h-299c

    Affected
    • Go filippo.io/age < 1.2.1
    Fixed in
    1.2.1· Vendor fix available
    Issue
    A plugin name containing a path separator may allow an attacker to execute an arbitrary binary. Such a plugin name can be provided to the age CLI through an attacker-controlled recipient or identity string, or to the plugin.NewIdentity, plugin.NewIdentityWithoutData, or plugin.NewRecipient APIs. On UNIX systems, a directory matching ${TMPDIR:-/tmp}/age-plugin- needs to exist for the attack to succeed. The binary is executed with a single flag, either --age-plugin=recipient-v1 or --age-plugin=identity-v1. The standard input includes the recipient or identity string, and the random file key (if encrypting) or the header of the file (if decrypting). The format is constrained by the age-plugin protocol. An equivalent issue was fixed by the rage project, see advisory GHSA-4fg7-vxc8-qx5w. Thanks to ⬡-49016 for reporting this.

    Recommended action: Upgrade to 1.2.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →