Vulnerability Details CVE-2020-8945
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.04
EPSS Ranking 87.9%
CVSS Severity
CVSS v3 Score 7.5
CVSS v2 Score 5.1
References
- https://access.redhat.com/errata/RHSA-2020:0679
- https://access.redhat.com/errata/RHSA-2020:0689
- https://access.redhat.com/errata/RHSA-2020:0697
- https://bugzilla.redhat.com/show_bug.cgi?id=1795838
- https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
- https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
- https://github.com/proglottis/gpgme/pull/23
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/
- https://access.redhat.com/errata/RHSA-2020:0679
- https://access.redhat.com/errata/RHSA-2020:0689
- https://access.redhat.com/errata/RHSA-2020:0697
- https://bugzilla.redhat.com/show_bug.cgi?id=1795838
- https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
- https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
- https://github.com/proglottis/gpgme/pull/23
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/
Products affected by CVE-2020-8945
-
cpe:2.3:a:gpgme_project:gpgme:0.1.0
-
cpe:2.3:a:redhat:openshift_container_platform:3.11
-
cpe:2.3:a:redhat:openshift_container_platform:4.1
-
cpe:2.3:a:redhat:openshift_container_platform:4.2
-
cpe:2.3:a:redhat:openshift_container_platform:4.3
-
cpe:2.3:a:redhat:openshift_container_platform:4.4
-
cpe:2.3:a:redhat:openshift_container_platform:4.5
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.1
-
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.2
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.1
-
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.2
-
cpe:2.3:o:fedoraproject:fedora:30
-
cpe:2.3:o:fedoraproject:fedora:31
-
cpe:2.3:o:fedoraproject:fedora:32
-
cpe:2.3:o:redhat:enterprise_linux:7.0
-
cpe:2.3:o:redhat:enterprise_linux:8.0
-
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0
-
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0
-
cpe:2.3:o:redhat:enterprise_linux_server:7.0
-
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0