NetSight
IP …
high7.5

CVE-2020-8945

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O.

Impact

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Affected products

VendorProductAffected versions
Gpgme ProjectGpgme
before 0.1.1
RedhatOpenshift Container Platform
Versions 3.11, 4.1, 4.2, 4.3, 4.4, 4.5
RedhatOpenshift Container Platform For Ibm Z
Versions 4.1, 4.2
RedhatOpenshift Container Platform For Linuxone
Versions 4.1, 4.2
FedoraprojectFedora
Versions 30, 31, 32
RedhatEnterprise Linux For Ibm Z Systems
Version 7.0
RedhatEnterprise Linux For Power Little Endian
Version 7.0
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-416

References