Ubuntu alert USN-8372-1 (age)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8372-1] age vulnerability
Date:
             
 
Tue, 02 Jun 2026 16:53:38 +0000
Message-ID:
             
 
<E1wUSN0-0002bJ-CE@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8372-1
June 02, 2026

age vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 24.04 LTS

Summary:

age could be made to crash or run programs as your login if it
opened a specially crafted file.

Software Description:
- age: A simple, modern and secure file encryption tool, format, and Go library.

Details:

It was discovered that age did not properly validate plugin names. An
attacker could possibly use this issue to cause execution of an
arbitrary program by supplying a crafted recipient or identity string.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 24.04 LTS
  age                             1.1.1-1ubuntu0.24.04.3+esm1
                                  Available with Ubuntu Pro
  golang-filippo-age-dev          1.1.1-1ubuntu0.24.04.3+esm1
                                  Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8372-1
  CVE-2024-56327


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmofCloACgkQcpJm3tlz
hgH6mBAAk2z/U38BFG9v5ZhdHPXe7ycnPvvmH8lSQfuvy8B6Sw4o5S1/V8/B0Ud3
T31Nd3NMSXG7Nk2ERjXG2WxPw3s3tjF4O1PN/zj+tcsAyXLF7vOBaf6FFzt8zbdQ
LNgdB3tSEEFdcun778EeMFgLo7h0wz1YywaIyZCWi10rdtszt8+lEZUV4Y55xe8n
y6NjOzfIDe7Ht4K4SmBrWtYmMGwpog3JPpQ11qo29yZfe2AKHpRUzd89j/44IDX1
votwI6AGoQkLtG6N9+f2w2tUBlSFpQ3kWqeIoTQKtJ4bE45UgfGswTAkyE4D7o3+
uIxz4WZMXTPkmY3DNiDPDqOvZu3+KbHIb1+bK9MeHasZU2HmM8RP9dJgXuDNRp5K
zPdCbyhgcvwh+2p292A7SciwKWBFKf+jTWQrwryhMS/Q8Qwo4F5Y/qFt6nnvov4k
mmAqkFS0DVdgnjCbaN2JOvw00JCOt8gpTSGAylhrREjCPRm0qjyKOKBjVKDbwBam
7+IV7/nIenEwhfz/rwIXj1e1y1UxsY0UWwjGcfsqSsh3fV0Is0snrJzo7WzGSY8w
Uh/1hTV3XIZUUYX35bmqq30Zqz8M3h8n4U30ZNKZt67yC1MtOZq6u/cmZw8O5C/c
DGAAtEnmI1G/Fb6NZh/ePWe0w36gFHDstusTKDQdTLOouniRNSE=
=d5KP
-----END PGP SIGNATURE-----