CVE-2020-8945: Vulnerability in github.com/proglottis/gpgme
Summary
GO-2020-0002: The Data, Context, or Key finalizers might run during or before GPGME operations. Affects github.com/proglottis/gpgme versions < 0.1.1. Fixed in 0.1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The github.com/proglottis/gpgme package is a Go library that provides bindings for the GPGME (GnuPG Made Easy) library. It allows developers to interact with GnuPG for encryption, decryption, signing, and verification of data. The package is commonly used in applications that require secure communication and data protection. However, a vulnerability has been discovered in the package that can lead to crashes and potential code execution.
Vulnerability Detail
The vulnerability (CVE-2020-8945) in github.com/proglottis/gpgme arises from the possibility of the Data, Context, or Key finalizers running during or before GPGME operations. This can result in the premature release of C structures that are still in use, leading to use-after-free vulnerabilities. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service. The vulnerability was fixed in version 0.1.1 of the package.
How To Fix
Minimum fixed version
0.1.1
This is the first release that contains the fix.
go get github.com/proglottis/gpgme@v0.1.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to update to the fixed version of the package to mitigate the risk.
Conclusion
The vulnerability in github.com/proglottis/gpgme can lead to crashes and potential code execution. It is crucial for developers to update their applications to use the fixed version of the package (0.1.1 or later) to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/proglottis/gpgme →
FAQ
github.com/proglottis/gpgme is a Go library that provides bindings for the GPGME library, allowing developers to interact with GnuPG for encryption, decryption, signing, and verification of data.
The vulnerability can lead to crashes and potential code execution. An attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service.
To fix the vulnerability, update your application to use version 0.1.1 or later of the github.com/proglottis/gpgme package.
No, there is no known workaround for this vulnerability. It is necessary to update to the fixed version of the package.
You can find more information about this vulnerability in the official vulnerability report at https://pkg.go.dev/vuln/GO-2020-0002.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/proglottis/gpgme.
