CoreCVE
Back

HIGH

proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

Published Feb 12, 2020

Description

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Affected products

Remediation

Red Hat statement

OpenShift 3.11 consumes updates for podman from the RHEL-7 extras channel, hence why it has been marked as wontfix in this instance. After extensive testing of the mentioned vulnerability Red Hat has chosen a severity of Moderate instead of High, because the deallocation of GPGME objects while other parts of code are still using it, the vulnerability can only result in a crash and cannot be used to execute code in any feasible manner, moreover the vulnerability only results in crash if finalizers are called to clean up variables while objects are still being used by the underlying C code. Given the inherent attack complexity being high and the exploitability of the vulnerability limited to a crash, Moderate severity seems adequate.

Metrics

Weaknesses (1)

CWE-416

Use After Free

References (21)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Feb 12, 2020
Updated Aug 4, 2024
Reserved Feb 12, 2020
Link CVE-2020-8945
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-8945
Red Hat
Severity Moderate
Public date Jan 16, 2020
Links CVE-2020-8945 - Bugzilla
GHSA-M6WG-2MWG-4RFQ