VDB

CVE-2020-8945

CVE-2020-8945 PUBLISHED CVSS 7.5 HIGH

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

EPSS 5.07% · 92.0th percentile

Risk Scores

CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score
5.07%
92.0th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSsingularity-container2.3.1-2, 2.4.2-2, 0
Ubuntu:25.10singularity-container0, *
Ubuntu:20.04:LTSgolang-github-proglottis-gpgme*, 0, 0.0~git20190226.8e0937a-1
Ubuntu:Pro:24.04:LTSsingularity-container4.1.1+ds2-1ubuntu0.2+esm1, 4.1.1+ds2-1ubuntu0.2, 4.1.1+ds2-1ubuntu0.1

Timeline

  • Feb 12, 2020 CVE Published
  • Apr 14, 2021 EPSS Score
  • May 18, 2021 CVE Updated
  • Aug 24, 2021 EPSS Score
  • Oct 26, 2021 EPSS Score
  • Jan 6, 2022 EPSS Score
  • Feb 4, 2022 EPSS Score
  • Apr 1, 2022 EPSS Score
  • May 2, 2022 EPSS Score
  • Sep 2, 2022 PoC Published
  • Sep 6, 2022 EPSS Score
  • Nov 8, 2022 EPSS Score

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›