CVE-2020-8945
High
Description
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Gpgme
PublishedFeb 12, 2020
First seenFeb 12, 2020
How to fix
Update
- gpgme_project gpgme0.1.1 or later
- github.com/proglottis/gpgme0.1.1 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/
- access.redhat.com/errata/RHSA-2020:0679
- access.redhat.com/errata/RHSA-2020:0689
- access.redhat.com/errata/RHSA-2020:0697
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gpgme_project gpgme | v < 0.1.1 | 0.1.1 |
| redhat openshift_container_platform | 3.11, 4.1, 4.2, 4.3, 4.4, 4.5 | — |
| redhat openshift_container_platform_for_ibm_z | 4.1, 4.2 | — |
| redhat openshift_container_platform_for_linuxone | 4.1, 4.2 | — |
| fedoraproject fedora | 30, 31, 32 | — |
| redhat enterprise_linux_for_ibm_z_systems | 7.0 | — |
| redhat enterprise_linux_for_power_little_endian | 7.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| github.com/proglottis/gpgmeGo | v < 0.1.1 | 0.1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.