{"id":"CVE-2020-8945","aliases":["DEBIAN-CVE-2020-8945","EUVD-2021-1136","GHSA-m6wg-2mwg-4rfq","GO-2021-0096","RHBA-2020:1255","RHSA-2020:0679","RHSA-2020:0689","RHSA-2020:0697","RHSA-2020:0928","RHSA-2020:1230","RHSA-2020:1231","RHSA-2020:1234","RHSA-2020:1396","RHSA-2020:1937","RHSA-2020:2027","RHSA-2020:2117","RHSA-2020:2413","RHSA-2020:2927","RHSA-2020:2992","UBUNTU-CVE-2020-8945"],"status":"published","title":"GPGME Go wrapper contains Use After Free","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05071,"percentile":0.92385,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2020-02-12T17:20:43Z","modified":"2026-10-26T12:02:55Z","fixes":[{"ecosystem":"Go","package":"github.com/proglottis/gpgme","fixed_in":["0.1.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"golang-github-proglottis-gpgme","fixed_in":["0.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-proglottis-gpgme","fixed_in":["0.1.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-proglottis-gpgme","fixed_in":["0.1.1-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"cri-o","fixed_in":["0:1.16.4-1.dev.rhaos4.3.git9238eee.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"cri-o-debuginfo","fixed_in":["0:1.16.4-1.dev.rhaos4.3.git9238eee.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o","fixed_in":["0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o-debuginfo","fixed_in":["0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o-debugsource","fixed_in":["0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"containers-common","fixed_in":["1:0.1.40-4.rhaos.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo","fixed_in":["1:0.1.40-4.rhaos.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-debuginfo","fixed_in":["1:0.1.40-4.rhaos.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-debugsource","fixed_in":["1:0.1.40-4.rhaos.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-tests","fixed_in":["1:0.1.40-4.rhaos.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"containers-common","fixed_in":["1:0.1.32-7.git1715c90.rhaos4.2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo","fixed_in":["1:0.1.32-7.git1715c90.rhaos4.2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo-debuginfo","fixed_in":["1:0.1.32-7.git1715c90.rhaos4.2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo-debugsource","fixed_in":["1:0.1.32-7.git1715c90.rhaos4.2.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"containers-common","fixed_in":["1:0.1.32-6.git1715c90.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo","fixed_in":["1:0.1.32-6.git1715c90.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo-debuginfo","fixed_in":["1:0.1.32-6.git1715c90.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo-debugsource","fixed_in":["1:0.1.32-6.git1715c90.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients","fixed_in":["0:4.3.7-202003130552.git.0.6027a27.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients-redistributable","fixed_in":["0:4.3.7-202003130552.git.0.6027a27.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients","fixed_in":["0:4.3.7-202003130552.git.0.6027a27.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients-redistributable","fixed_in":["0:4.3.7-202003130552.git.0.6027a27.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"containers-common","fixed_in":["1:0.1.40-7.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"skopeo","fixed_in":["1:0.1.40-7.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"skopeo-debuginfo","fixed_in":["1:0.1.40-7.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"buildah","fixed_in":["0:1.11.6-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"buildah-debuginfo","fixed_in":["0:1.11.6-8.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"openshift-clients","fixed_in":["0:4.2.32-202005020632.git.1.1b0fab9.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"openshift-clients-redistributable","fixed_in":["0:4.2.32-202005020632.git.1.1b0fab9.el8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/proglottis/gpgme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-proglottis-gpgme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-proglottis-gpgme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-proglottis-gpgme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.1-1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/proglottis/gpgme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/proglottis/gpgme","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.1.1"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.4-1.dev.rhaos4.3.git9238eee.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.4-1.dev.rhaos4.3.git9238eee.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.16.4-1.dev.rhaos4.3.git9238eee.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-4.rhaos.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-4.rhaos.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-4.rhaos.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-4.rhaos.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-4.rhaos.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-7.git1715c90.rhaos4.2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-7.git1715c90.rhaos4.2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-7.git1715c90.rhaos4.2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-7.git1715c90.rhaos4.2.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-6.git1715c90.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-6.git1715c90.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-6.git1715c90.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.32-6.git1715c90.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.7-202003130552.git.0.6027a27.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.7-202003130552.git.0.6027a27.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.7-202003130552.git.0.6027a27.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.3.7-202003130552.git.0.6027a27.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-7.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-7.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-7.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-8.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-logrotate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-lvm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-novolume-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-rhel-push-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-v1.10-migrator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-manpages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.rhaos4.3.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"cri-o-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.32-202005020632.git.1.1b0fab9.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.32-202005020632.git.1.1b0fab9.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-18.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-18.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-18.el7_8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el7"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.0.582d7fc.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.5::el8","package":"machine-config-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.5.0-202007012112.p0.git.2527.d12c3da.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-202007090832.p0.git.0.bc32fb1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el7","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-202007090832.p0.git.0.bc32fb1.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-202007090832.p0.git.0.bc32fb1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-202007090832.p0.git.0.bc32fb1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:4.4::el8","package":"machine-config-daemon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.0-202007092124.p0.git.2349.08d34d1.el8"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"cri-o","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"cri-o-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.16-0.10.dev.rhaos3.11.git1eee681.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.1.cc96c2d.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.248-1.git.0.92ee8ac.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.1-2","2.3.2-1","2.4.1-1","2.4.2-2","2.4.2-3","2.4.2-4","2.4.2-4ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"golang-github-proglottis-gpgme","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.0~git20181127.3b0be09-2","0.0~git20190226.8e0937a-1","0.1.0-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.1+ds2-1","4.1.1+ds2-1build1","4.1.1+ds2-1ubuntu0.1","4.1.1+ds2-1ubuntu0.2","4.1.1+ds2-1ubuntu0.2+esm1","4.1.1+ds2-1ubuntu0.3","4.1.1+ds2-1ubuntu0.3+esm1","4.1.1+ds2-1ubuntu0.3+esm2"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.5+ds4-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"singularity-container","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.1.5+ds4-1"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"gpgme_project","product":"gpgme"},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems"},{"vendor":"redhat","product":"enterprise_linux_for_power_little_endian"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"redhat","product":"openshift_container_platform"},{"vendor":"redhat","product":"openshift_container_platform_for_ibm_z"},{"vendor":"redhat","product":"openshift_container_platform_for_linuxone"}],"references":[{"url":"https://github.com/proglottis/gpgme/pull/23","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795838","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0679","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0689","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0697","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8945","tags":["advisory"]},{"url":"https://github.com/proglottis/gpgme/commit/92153bcb59bd2f511e502262c46c7bd660e21733","tags":["web","fix"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM/"},{"url":"https://pkg.go.dev/vuln/GO-2021-0096","tags":["web"]},{"url":"https://github.com/advisories/GHSA-m6wg-2mwg-4rfq"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8945","tags":["advisory"]},{"url":"https://github.com/proglottis/gpgme","tags":["package"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/H6P6SSNKN4H6GSEVROHBDXA64PX7EOED","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KDBT77KV3U7BESJX3P4S4MPVDGRTAQA2","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WXV7NZELYWRRCXATXU3FYD3G3WJT3WYM","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2020:1255","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1816992","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1255.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8945","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0679.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0689.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0697.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0928","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0928.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1230","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1752775","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1812505","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1230.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1231","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1765469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791286","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1231.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1234","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796451","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1234.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16884","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16884","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16884","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1702","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1396","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1817651","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1396.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10696","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10696","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10696","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1937","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1937.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2027","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2027.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2117","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2117.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2413","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1819486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1843358","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2413.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11252","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1860158","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11252","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11252","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11254","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11254","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8558","tags":["advisory"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-9283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804533","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-9283","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-9283","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2927","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2927.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:2992","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1767665","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1772280","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1797909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813344","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2992.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14891","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14891","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14891","tags":["advisory"]},{"url":"https://capsule8.com/blog/oomypod-nothin-to-cri-o-bout/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-7598","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-7598","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-7598","tags":["advisory"]},{"url":"https://snyk.io/vuln/SNYK-JS-MINIMIST-559764","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8552","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8552","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8552","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/89378","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/2UOlsba2g0s","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-10715","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-10715","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10715","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8945","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8945","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T17:20:43Z","modified":"2024-08-04T10:12:10.975Z","updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2021-1136","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T17:20:43Z","modified":"2024-08-04T10:12:10Z","updated_at":"2026-11-03T03:07:55.71159Z"}],"ghsa":[{"id":"GHSA-m6wg-2mwg-4rfq","title":"GPGME Go wrapper contains Use After Free","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2021-05-18T15:29:42Z","modified":"2023-02-14T00:12:15Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:36:44.81167Z"}],"nvd":[{"id":"CVE-2020-8945","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T18:15:10.47Z","modified":"2026-06-17T03:27:13.043Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5.1,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:05:53.837808Z"}],"osv":[{"id":"CVE-2020-8945","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T18:15:10.47Z","modified":"2026-10-20T10:52:15.988314555Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8945","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T18:15:10.47Z","modified":"2026-10-26T12:02:55.368387796Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-m6wg-2mwg-4rfq","title":"GPGME Go wrapper contains Use After Free","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2021-05-18T15:29:42Z","modified":"2024-05-19T02:23:55.198616Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"RHBA-2020:1255","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.10 packages update","status":"published","published":"2024-09-13T22:40:08Z","modified":"2026-03-23T04:46:08.770373Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2020:0679","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.5 skopeo security update","status":"published","published":"2024-09-13T22:39:46Z","modified":"2026-03-23T04:46:09.330987Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0689","title":"Red Hat Security Advisory: OpenShift Container Platform 4.2.22 skopeo security update","status":"published","published":"2024-09-13T22:39:39Z","modified":"2026-03-23T04:46:09.092181Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0697","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.38 skopeo security update","status":"published","published":"2024-09-13T22:40:01Z","modified":"2026-03-23T04:47:28.713212Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0928","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.8 openshift-clients security update","status":"published","published":"2024-09-13T22:39:57Z","modified":"2026-03-23T04:46:00.023782Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1230","title":"Red Hat Security Advisory: skopeo security and bug fix update","status":"published","published":"2024-09-13T22:39:04Z","modified":"2026-06-26T10:47:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1231","title":"Red Hat Security Advisory: buildah security and bug fix update","status":"published","published":"2024-09-13T22:39:12Z","modified":"2026-06-26T10:47:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1234","title":"Red Hat Security Advisory: docker security and bug fix update","status":"published","published":"2024-09-13T22:39:19Z","modified":"2026-06-27T10:09:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1396","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.12 podman security update","status":"published","published":"2024-09-16T03:52:36Z","modified":"2026-08-08T10:01:43Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:1937","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.3 cri-o security update","status":"published","published":"2024-09-13T22:40:05Z","modified":"2026-06-27T10:10:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2027","title":"Red Hat Security Advisory: OpenShift Container Platform 4.2.33 openshift-clients security update","status":"published","published":"2024-09-13T22:40:28Z","modified":"2026-03-23T04:46:00.194036Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2117","title":"Red Hat Security Advisory: podman security update","status":"published","published":"2024-09-16T03:53:22Z","modified":"2026-08-08T10:01:47Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2413","title":"Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update","status":"published","published":"2024-09-30T13:54:06Z","modified":"2026-10-19T10:01:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2927","title":"Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update","status":"published","published":"2024-09-16T04:20:14Z","modified":"2026-03-23T04:49:23.835184Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:2992","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11 security update","status":"published","published":"2024-09-16T04:36:16Z","modified":"2026-10-09T10:01:50Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"UBUNTU-CVE-2020-8945","description":"The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.","status":"published","published":"2020-02-12T18:15:00Z","modified":"2026-05-20T16:04:39.650986822Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"GO-2021-0096","title":"Memory corruption or code execution in github.com/proglottis/gpgme","description":"Due to improper setting of finalizers, memory passed to C may be freed before it is used, leading to crashes due to memory corruption or possible code execution.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2024-05-20T16:03:47Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}