CVE-2020-8945

Опубликовано: 12 фев. 2020

Источник: nvd

CVSS3: 7.5

CVSS2: 5.1

EPSS Низкий

Описание

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Ссылки

https://access.redhat.com/errata/RHSA-2020:0679
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0689
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0697
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1795838
Issue Tracking
Patch
Third Party Advisory
https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
Patch
Third Party Advisory
https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
Patch
Third Party Advisory
https://github.com/proglottis/gpgme/pull/23
Exploit
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/
https://access.redhat.com/errata/RHSA-2020:0679
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0689
Third Party Advisory
https://access.redhat.com/errata/RHSA-2020:0697
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1795838
Issue Tracking
Patch
Third Party Advisory
https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
Patch
Third Party Advisory
https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
Patch
Third Party Advisory
https://github.com/proglottis/gpgme/pull/23
Exploit
Patch
Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gpgme_project:gpgme:*:*:*:*:*:go:*:*

Версия до 0.1.1 (исключая)

Конфигурация 2

Одновременно

Одно из

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.2:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.1:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.2:*:*:*:*:*:*:*

Одно из

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Конфигурация 5

cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*

EPSS

Процентиль: 88%

0.04013

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-416

Связанные уязвимости

CVE-2020-8945

CVSS3: 7.5

ubuntu

больше 5 лет назад

CVE-2020-8945

CVSS3: 7.5

redhat

больше 5 лет назад

CVE-2020-8945

CVSS3: 7.5

debian

больше 5 лет назад

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use ...

GHSA-m6wg-2mwg-4rfq

CVSS3: 7.5

github

около 4 лет назад

GPGME Go wrapper contains Use After Free

ELSA-2020-1230

oracle-oval

почти 5 лет назад

ELSA-2020-1230: skopeo security and bug fix update (MODERATE)

EPSS

Процентиль: 88%

0.04013

Низкий

7.5 High

CVSS3

5.1 Medium

CVSS2

Дефекты

CWE-416