CVE-2020-8945: Use After Free in GPGME Go Wrapper
Summary
CVE-2020-8945: Memory corruption or code execution in github.com/proglottis/gpgme. Affects github.com/proglottis/gpgme versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Also tracked for
- golang-github-proglottis-gpgme · Debian:11
The same CVE-2020-8945 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The GPGME Go wrapper is a package that provides bindings for the GPGME library in the Go programming language. GPGME is a library that allows applications to interact with the GNU Privacy Guard (GnuPG) cryptographic software. It provides functions for encryption, decryption, signing, and verification of data using GnuPG. The GPGME Go wrapper enables developers to utilize GPGME functionality in their Go applications. However, versions before 0.1.1 of the proglottis Go wrapper for GPGME are vulnerable to a use-after-free issue.
Vulnerability Detail
The vulnerability in the proglottis Go wrapper for GPGME arises from a use-after-free bug. This bug occurs when the wrapper attempts to use memory that has already been freed. The vulnerability can be triggered during GPG signature verification, specifically when the wrapper is used for container image pulls by Docker or CRI-O. Exploiting this vulnerability can lead to a crash or potential code execution. The severity of this vulnerability is rated as HIGH with a CVSS score of 7.5.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
go get github.com/proglottis/gpgme@v0.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update to the fixed version of the proglottis Go wrapper to mitigate the risk of exploitation.
Conclusion
The proglottis Go wrapper for GPGME versions before 0.1.1 is vulnerable to a use-after-free issue that can result in a crash or potential code execution. To mitigate this vulnerability, it is crucial to update to version 0.1.1 or later of the wrapper. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/proglottis/gpgme →
FAQ
GPGME is a library that allows applications to interact with the GNU Privacy Guard (GnuPG) cryptographic software. It provides functions for encryption, decryption, signing, and verification of data using GnuPG.
The proglottis Go wrapper is a package that provides bindings for the GPGME library in the Go programming language. It enables developers to utilize GPGME functionality in their Go applications.
A use-after-free vulnerability occurs when a program attempts to use memory that has already been freed. This can lead to crashes, unexpected behavior, or potential code execution.
This vulnerability can be exploited during GPG signature verification, specifically when the proglottis Go wrapper is used for container image pulls by Docker or CRI-O.
This vulnerability is rated as HIGH with a CVSS score of 7.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/proglottis/gpgme.
