The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade docker-v1.10-migratorUpgrade buildah-debuginfoUpgrade docker-commonUpgrade podman-debuginfoUpgrade containers-commonUpgrade docker-clientUpgrade skopeoUpgrade dockerUpgrade podmanUpgrade docker-debuginfoUpgrade buildahUpgrade docker-novolume-pluginUpgrade skopeo-debuginfoUpgrade docker-lvm-pluginUpgrade docker-rhel-push-pluginUpgrade docker-logrotateUpgrade podman-docker | Apr 2, 2020 | Feb 12, 2020 |
| Debian | — | Upgrade golang-github-proglottis-gpgme | Jul 30, 2024 | Feb 12, 2020 |
| Huawei Euleros 2_0_sp8 | — | — | Mar 24, 2020 | Feb 12, 2020 |
| Redhat Openshift | — | Upgrade podmanUpgrade openshift-clientsUpgrade skopeoUpgrade machine-config-daemonUpgrade atomic-openshiftUpgrade cri-o | Mar 11, 2020 | Jan 16, 2020 |
| Redhat_linux | — | Upgrade docker-novolume-pluginUpgrade docker-clientUpgrade containers-commonUpgrade skopeo-debuginfoUpgrade docker-rhel-push-pluginUpgrade podman-dockerUpgrade docker-debuginfoUpgrade docker-v1.10-migratorUpgrade docker-logrotateUpgrade skopeoUpgrade buildah-debuginfoUpgrade buildahUpgrade podman-debuginfoNo solution existsUpgrade docker-lvm-pluginUpgrade docker-commonUpgrade dockerUpgrade podman | Apr 2, 2020 | Feb 12, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub