Candidate: CVE-2020-8945
PublicDate: 2020-02-12 18:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8945
 https://github.com/proglottis/gpgme/pull/23
 https://bugzilla.redhat.com/show_bug.cgi?id=1795838
 https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
 https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
Description:
 The proglottis Go wrapper before 0.1.1 for the GPGME library has a
 use-after-free, as demonstrated by use for container image pulls by Docker
 or CRI-O. This leads to a crash or potential code execution during GPG
 signature verification.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H [7.5 HIGH]


Patches_golang-github-proglottis-gpgme:
upstream_golang-github-proglottis-gpgme: needs-triage
precise/esm_golang-github-proglottis-gpgme: DNE
trusty_golang-github-proglottis-gpgme: ignored (out of standard support)
trusty/esm_golang-github-proglottis-gpgme: DNE
xenial_golang-github-proglottis-gpgme: DNE
bionic_golang-github-proglottis-gpgme: DNE
eoan_golang-github-proglottis-gpgme: ignored (reached end-of-life)
focal_golang-github-proglottis-gpgme: needs-triage
groovy_golang-github-proglottis-gpgme: not-affected (0.1.1-1)
hirsute_golang-github-proglottis-gpgme: not-affected (0.1.1-1)
impish_golang-github-proglottis-gpgme: not-affected (0.1.1-1)
jammy_golang-github-proglottis-gpgme: not-affected (0.1.1-1)
devel_golang-github-proglottis-gpgme: not-affected (0.1.1-1)

Patches_singularity-container:
upstream_singularity-container: needs-triage
precise/esm_singularity-container: DNE
trusty_singularity-container: ignored (out of standard support)
trusty/esm_singularity-container: DNE
xenial_singularity-container: DNE
bionic_singularity-container: needs-triage
eoan_singularity-container: ignored (reached end-of-life)
focal_singularity-container: DNE
groovy_singularity-container: DNE
hirsute_singularity-container: DNE
impish_singularity-container: DNE
jammy_singularity-container: DNE
devel_singularity-container: DNE