Use-after-free in gpgme - CVE-2020-8945

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU25501

Use-after-free in gpgme - CVE-2020-8945

Published: February 21, 2020 / Updated: March 17, 2020


Vulnerability identifier: #VU25501
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8945
CWE-ID: CWE-416
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error, as demonstrated by use for container image pulls by Docker or CRI-O. A remote attacker can crash the target system, or cause potential code execution for Go applications that use this library under certain conditions during GPG signature verification.


Affected software

gpgme
skopeo (Red Hat package)
cri-o (Red Hat package)
podman (Red Hat package)
docker (Red Hat package)
conmon (Red Hat package)
openshift (Red Hat package)
openshift-clients (Red Hat package)
openshift-ansible (Red Hat package)
machine-config-daemon (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
openshift-kuryr (Red Hat package)
skopeo
podman
podman-remote
podman-tests
podman-docker
buildah (Red Hat package)
cri-o
origin
Red Hat OpenShift Container Platform
Red Hat Enterprise Linux for Power, little endian
Anolis OS
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Fedora
Sun Java Studio Enterprise

How to mitigate CVE-2020-8945

Install updates from vendor's website.

gpgme - update to 0.1.1
skopeo (Red Hat package) - update to 0.1.40-7.el7_8
cri-o (Red Hat package) - addressed in versions 1.16.4-1.dev.rhaos4.3.git9238eee.el7, 1.16.4-1.dev.rhaos4.3.git9238eee.el8, 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7, 1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8
podman (Red Hat package) - update to 1.6.4-18.el7_8
docker (Red Hat package) - update to 1.13.1-161.git64e9980.el7_8
conmon (Red Hat package) - addressed in versions 2.0.8-3.rhaos4.3.el7, 2.0.9-3.rhaos4.3.el8
Red Hat OpenShift Container Platform - addressed in versions 4.1.38, 4.2.22, 4.3.5, 4.3.8, 4.3.9, 4.4.3
openshift (Red Hat package) - addressed in versions 4.3.10-202003300855.git.0.da48c1d.el7, 4.3.10-202003300855.git.0.da48c1d.el8, 4.4.0-202007090832.p0.git.0.bc32fb1.el7, 4.4.0-202007090832.p0.git.0.bc32fb1.el8, 4.5.0-202007012112.p0.git.0.582d7fc.el7, 4.5.0-202007012112.p0.git.0.582d7fc.el8
openshift-clients (Red Hat package) - addressed in versions 4.2.32-202005020632.git.1.1b0fab9.el8, 4.3.7-202003130552.git.0.6027a27.el7, 4.3.7-202003130552.git.0.6027a27.el8, 4.3.10-202003300001.git.0.e43c148.el8, 4.3.10-202003300415.git.0.3576c99.el7
openshift-ansible (Red Hat package) - update to 4.3.10-202003300415.git.0.6fe3ef9.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.3.10-202003300415.git.0.56d6ae0.el8, 4.4.0-202007092124.p0.git.2349.08d34d1.el8, 4.5.0-202007012112.p0.git.2527.d12c3da.el8
atomic-openshift-service-idler (Red Hat package) - update to 4.3.10-202003300415.git.13.ac05c4a.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 4.3.10-202003300415.git.0.68d5fb7.el7
openshift-kuryr (Red Hat package) - update to 4.3.10-202003300855.git.0.07e6ba6.el8
skopeo - addressed in versions 0.1.41-1.fc30, 0.1.41-1.fc31
podman - update to 1.6.4-36
podman-remote - update to 1.6.4-36
podman-tests - update to 1.6.4-36
podman-docker - update to 1.6.4-36
podman - addressed in versions 1.8.0-2.fc30, 1.8.0-3.fc30, 1.8.0-4.fc30
buildah (Red Hat package) - update to 1.11.6-8.el7_8
cri-o - addressed in versions 1.14-3020200226174119.a5b0195c, 1.14-3120200226174119.f636be4b
origin - update to 3.11.2-1.fc32

External References

Related Security Bulletins