CVE-2020-8945 PUBLISHED

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

EPSS 1.94% · 83.3th percentile

Risk Scores

EPSS Score
1.94%
83.3th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:18.04:LTSsingularity-container0, 2.3.1-2, 2.3.2-1
Ubuntu:25.10singularity-container4.1.5+ds4-1, 0
Ubuntu:20.04:LTSgolang-github-proglottis-gpgme0.0~git20190226.8e0937a-1, 0.1.0-1, 0
Ubuntu:Pro:24.04:LTSsingularity-container4.1.1+ds2-1build1, 4.1.1+ds2-1ubuntu0.1, 4.1.1+ds2-1ubuntu0.2

Timeline

References

Open in Interactive Console →