CVE-2020-8945

Katalog CVE

CVSS 7.5 · High EPSS 5,1%

Kerentanan Use After Free pada gpgme project gpgme, redhat openshift container platform +7 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Rincian

Terbit di NVD

12 Februari 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

5,1% peluang dieksploitasi; lebih tinggi dari 92,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://bugzilla.redhat.com/show_bug.cgi?id=1795838 issue tracking · patch · advisory pihak ketiga
• https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1 patch · advisory pihak ketiga
• https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1 patch · advisory pihak ketiga
• https://github.com/proglottis/gpgme/pull/23 exploit · patch · advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0679 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0689 advisory pihak ketiga
• https://access.redhat.com/errata/RHSA-2020:0697 advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABT...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6G...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BE...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRC...