CVE-2020-8945

CWE-416 — Use After Free20 documents7 sources
Severity
7.5HIGH
EPSS
1.9%
top 16.58%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
10
Github.com Proglottis/gpgmeGpgme Project GpgmeFedoraproject Fedora+7 more
Timeline
PublishedFeb 12
Latest updateMay 18

Description

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages6 packages

▶Debiangolang-github-proglottis-gpgme< 0.1.1-1+3
▶NVDgpgme_project/gpgme< 0.1.1
▶CVEListV5podmanpodman 1.6.4-32.el7_9

Also affects: Openshift Container Platform 3.11, 4.1, 4.2, 4.3, 4.4, 4.5, Fedora 30, 31, 32, Enterprise Linux 7.0

Patches

Patch: bugzilla.redhat.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

5
OSV
GPGME Go wrapper contains Use After Free↗2021-05-18
▶
GHSA
GPGME Go wrapper contains Use After Free↗2021-05-18
▶
OSV
Memory corruption or code execution in github.com/proglottis/gpgme↗2021-04-14
▶
CVEList
CVE-2020-8945: The proglottis Go wrapper before 0↗2020-02-12
▶
OSV
CVE-2020-8945: The proglottis Go wrapper before 0↗2020-02-12
▶

📋Vendor Advisories

2
Red Hat
proglottis/gpgme: Use-after-free in GPGME bindings during container image pull↗2020-01-16
▶
Debian
CVE-2020-8945: golang-github-proglottis-gpgme - The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-fre...↗2020
▶

💬Community

12
Bugzilla
CVE-2020-8945 buildah: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull [fedora-all]↗2020-02-17
▶
Bugzilla
CVE-2020-8945 docker: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull [openstack-rdo]↗2020-02-14
▶
Bugzilla
CVE-2020-8945 cri-o:1.11/cri-o: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull [fedora-all]↗2020-02-14
▶
Bugzilla
CVE-2020-8945 docker: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull [fedora-all]↗2020-02-14
▶
Bugzilla
CVE-2020-8945 cri-o:1.14/cri-o: proglottis/gpgme: Use-after-free in GPGME bindings during container image pull [fedora-all]↗2020-02-14
▶