GitHub Advisoryadvisory · Go

GHSA-m6wg-2mwg-4rfq GPGME Go wrapper contains Use After Free

HIGH Published 2021-05-18 Modified 2023-02-14 Official page ↗
Aliases
CVE-2020-8945
Ecosystem
Go
Packages
github.com/proglottis/gpgme
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weaknesses
CWE-416
Reviewed
2021-05-17

Affected packages

• Go github.com/proglottis/gpgme: < 0.1.1 → fixed in 0.1.1

Description

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Related

Alias · CVE (1)

  • CVE-2020-8945 The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by… vulnerability

Weakness · CWE (1)

References