Skip to content
Fencer Intel
high 7.5

CVE-2020-8945 json

GPGME Go wrapper contains Use After Free

published 6y ago modified 4mo ago also GHSA-m6wg-2mwg-4rfq , GO-2021-0096 , EUVD-2021-1136

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.1%
EPSS 5.1% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Patch / fix

  • go github.com/proglottis/gpgme 0.1.1
  • gpgme_project gpgme 0.1.1
  • golang-github-proglottis-gpgme Debian 14, Debian 13, Debian 12 0.1.1-1

debian advisories DEBIAN-CVE-2020-8945

  • openshift openshift 4.5 4.5.0-202007012112.p0.git.0.582d7fc.el7
  • openshift openshift 4.5 4.5.0-202007012112.p0.git.0.582d7fc.el8
  • openshift-hyperkube openshift 4.5 4.5.0-202007012112.p0.git.0.582d7fc.el7
  • openshift-hyperkube openshift 4.5 4.5.0-202007012112.p0.git.0.582d7fc.el8
  • machine-config-daemon openshift 4.5 4.5.0-202007012112.p0.git.2527.d12c3da.el8
  • cri-o openshift 3.11 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7
  • atomic-openshift openshift 3.11 3.11.248-1.git.0.92ee8ac.el7
  • atomic-openshift-pod openshift 3.11 3.11.248-1.git.0.92ee8ac.el7

red hat advisories RHSA-2020:2413RHSA-2020:2992RHSA-2020:2927RHSA-2020:2117RHSA-2020:1396RHSA-2020:2027

Is CVE-2020-8945 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8945 updated cvss 7.5

proglottis/gpgme: Use-after-free in GPGME bindings during container image pull

  • Red Hat Enterprise Linux 8 podman, skopeo, buildah, podman-tests, skopeo-tests, buildah-tests, +7 more
    affected: no fix available, no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 cri-o, podman Red Hat OpenShift Container Platform 4 openshift, openshift-clients, openshift-kubelet, openshift-hyperkube, openshift-kube-apiserver, openshift-kube-scheduler, +3 more
    affected: no fix planned “Will not fix”
  • Red Hat Enterprise Linux 7 Extras podman 1.6.4-18.el7_8, skopeo 0.1.40-7.el7_8, buildah 1.11.6-8.el7_8, podman-docker 1.6.4-18.el7_8, containers-common 0.1.40-7.el7_8, docker 1.13.1-161.git64e9980.el7_8, +7 more
    fixed: vendor fix RHSA-2020:1231
  • Red Hat OpenShift Container Platform 3.11 atomic-openshift 3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-pod 3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-node 3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-tests 3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-master 3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients 3.11.248-1.git.0.92ee8ac.el7, +7 more
    fixed: vendor fix RHSA-2020:2992
  • Red Hat OpenShift Container Platform 4.1 skopeo 0.1.32-6.git1715c90.el8_0, containers-common 0.1.32-6.git1715c90.el8_0
    fixed: vendor fix RHSA-2020:0697
  • Red Hat OpenShift Container Platform 4.2 skopeo 0.1.32-7.git1715c90.rhaos4.2.el8, containers-common 0.1.32-7.git1715c90.rhaos4.2.el8, openshift4/ose-docker-builder v4.2.28-202004061218, openshift-clients 4.2.32-202005020632.git.1.1b0fab9.el8, openshift4/ose-openshift-controller-manager-rhel7 v4.2.34-202005252115, openshift-clients-redistributable 4.2.32-202005020632.git.1.1b0fab9.el8
    fixed: vendor fix RHSA-2020:1402
  • Red Hat OpenShift Container Platform 4.3 skopeo 0.1.40-4.rhaos.el8, podman 1.6.4-10.rhaos4.3.el8, skopeo-tests 0.1.40-4.rhaos.el8, podman-tests 1.6.4-10.rhaos4.3.el8, podman-docker 1.6.4-10.rhaos4.3.el8, podman-remote 1.6.4-10.rhaos4.3.el8, +12 more
    fixed: vendor fix RHBA-2020:1255
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-cli v4.4.0-202004261927, openshift4/ose-pod v4.4.0-202004261927, openshift4/ose-etcd v4.4.0-202004261927, openshift4/ose-tests v4.4.0-202004261927, cri-o 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7, cri-o 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8, +79 more
    fixed: vendor fix RHSA-2020:1937
show 3 more
  • Red Hat OpenShift Container Platform 4.5 openshift4/ose-cli v4.5.0-202007012112.p0, openshift4/ose-pod v4.5.0-202007012112.p0, openshift4/ose-etcd v4.5.0-202007012112.p0, openshift4/ose-tests v4.5.0-202007100518.p0, openshift4/ose-coredns v4.5.0-202007012112.p0, openshift4/ose-grafana v4.5.0-202007012112.p0, +72 more
    fixed: vendor fix RHBA-2020:2409
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-pod v4.6.0-202010061132.p0, openshift4/ose-jenkins v4.6.0-202010120952.p0, openshift4/ose-deployer v4.6.0-202010080605.p0, openshift4/ose-sdn-rhel8 v4.6.0-202010061132.p0, openshift4/ose-telemeter v4.6.0-202010061132.p0, openshift4/ose-kube-proxy v4.6.0-202010061132.p0, +49 more
    fixed: vendor fix RHBA-2020:4196
  • Red Hat Ansible Tower 3 openshift-clients Red Hat OpenShift Container Platform 3.11 cri-o 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7, atomic-openshift-web-console 3.11.248-1.git.1.cc96c2d.el7 Red Hat OpenShift Container Platform 4 openshift4/ose-hypershift, template-service-broker-container Red Hat OpenShift Container Platform 4.3 conmon 2.0.8-3.rhaos4.3.el7, conmon 2.0.9-3.rhaos4.3.el8, openshift 4.3.10-202003300855.git.0.da48c1d.el7, openshift 4.3.10-202003300855.git.0.da48c1d.el8, openshift-kuryr 4.3.10-202003300855.git.0.07e6ba6.el8, openshift-ansible 4.3.10-202003300415.git.0.6fe3ef9.el7, +15 more Red Hat OpenShift Container Platform 4.4 openshift 4.4.0-202007090832.p0.git.0.bc32fb1.el7, openshift 4.4.0-202007090832.p0.git.0.bc32fb1.el8, openshift-hyperkube 4.4.0-202007090832.p0.git.0.bc32fb1.el7, openshift-hyperkube 4.4.0-202007090832.p0.git.0.bc32fb1.el8 Red Hat OpenShift Container Platform 4.5 openshift 4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift 4.5.0-202007012112.p0.git.0.582d7fc.el8, openshift-hyperkube 4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift-hyperkube 4.5.0-202007012112.p0.git.0.582d7fc.el8
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

5.07% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • github.com https://github.com/proglottis/gpgme/pull/23 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/proglottis/gpgme
<0.1.1
0.1.1

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.