CVE-2020-8945

Published: Feb 12, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Affected (18)

Products: Gpgme Project: Gpgme · Redhat: Openshift Container Platform, Openshift Container Platform For Ibm Z, Openshift Container Platform For Linuxone, Enterprise Linux For Ibm Z Systems, Enterprise Linux For Power Little Endian, Enterprise Linux Server, Enterprise Linux Workstation · Fedoraproject: Fedora

1 product

7 products

Openshift Container Platform

Openshift Container Platform For Ibm Z

Openshift Container Platform For Linuxone

Enterprise Linux For Ibm Z Systems

Enterprise Linux For Power Little Endian

Enterprise Linux Server

Enterprise Linux Workstation

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gpgme Project Gpgme	Before 0.1.1

Configuration B

9 vulnerable · 2 platform

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 4.1
Redhat Openshift Container Platform	Version 4.2
Redhat Openshift Container Platform	Version 4.3
Redhat Openshift Container Platform	Version 4.4
Redhat Openshift Container Platform	Version 4.5
Redhat Openshift Container Platform For Ibm Z	Version 4.1
Redhat Openshift Container Platform For Ibm Z	Version 4.2
Redhat Openshift Container Platform For Linuxone	Version 4.1
Redhat Openshift Container Platform For Linuxone	Version 4.2

Running on/with	Platform Versions
Redhat Enterprise Linux	Version 7.0
Redhat Enterprise Linux	Version 8.0

Configuration C

3 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31
Fedoraproject Fedora	Version 32

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Redhat Enterprise Linux For Ibm Z Systems	Version 7.0
Redhat Enterprise Linux For Power Little Endian	Version 7.0
Redhat Enterprise Linux Server	Version 7.0
Redhat Enterprise Linux Workstation	Version 7.0

Configuration E

1 vulnerable

Vulnerable Software	Affected Versions
Redhat Openshift Container Platform	Version 3.11

Related CWEs

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

References (22)

https://access.redhat.com/errata/RHSA-2020:0679

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0689

Source: cve@mitre.org

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0697

Source: cve@mitre.org

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1795838

Source: cve@mitre.org

Issue TrackingPatchThird Party Advisory

https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/proglottis/gpgme/pull/23

Source: cve@mitre.org

ExploitPatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/

Source: cve@mitre.org

https://access.redhat.com/errata/RHSA-2020:0679

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0689

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://access.redhat.com/errata/RHSA-2020:0697

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://bugzilla.redhat.com/show_bug.cgi?id=1795838

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingPatchThird Party Advisory

https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/proglottis/gpgme/pull/23

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.