Read the docs
TI-2020-07179 Aliases CVE-2020-8945GHSA-m6wg-2mwg-4rfq

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as…

Priority MEDIUM 41CWE-416Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-416 and the CVSS impact.

Summary

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

Why it matters now

EPSS 0.05071 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial github.com/proglottis/gpgme (Go): 0.1.1Red Hat: 19 advisoriesRed Hat: 8 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—github.com/proglottis/gpgme (Go)before 0.1.10.1.1Patch availableGHSA-m6wg-2mwg-4rfq
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • github.com/proglottis/gpgme (Go) Vendor— Affected before 0.1.1 Fixed in 0.1.1 Patch available GHSA-m6wg-2mwg-4rfq

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:gpgme_project:gpgme:*:*:*:*:*:go:*:*before 0.1.1VulnerableGpgme Project
cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*3.11VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:*4.3VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:*4.4VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:*4.5VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.1:*:*:*:*:*:*:*4.1VulnerableRed Hat
  • cpe:2.3:a:gpgme_project:gpgme:*:*:*:*:*:go:*:* Versions before 0.1.1 Vulnerable ·Gpgme Project
  • cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:* Versions 3.11 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.4:*:*:*:*:*:*:* Versions 4.4 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform:4.5:*:*:*:*:*:*:* Versions 4.5 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_ibm_z:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.1:*:*:*:*:*:*:* Versions 4.1 Vulnerable ·Red Hat
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.2:*:*:*:*:*:*:*4.2VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*7.0Running onRed Hat
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*8.0Running onRed Hat
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*30VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*31VulnerableFedoraproject
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*32VulnerableFedoraproject
cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*7.0VulnerableRed Hat
  • cpe:2.3:a:redhat:openshift_container_platform_for_linuxone:4.2:*:*:*:*:*:*:* Versions 4.2 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Running on ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Running on ·Red Hat
  • cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:* Versions 30 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* Versions 31 Vulnerable ·Fedoraproject
  • cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
  • cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
  • cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-m6wg-2mwg-4rfq github.com/proglottis/gpgme (Go) Fixed in 0.1.1 Advisory →

Red Hat 19 advisories

  • RHSA-2020:3167 Released 2020-07-28 · Red Hat rating Moderate
    OpenShift Container Platform 4.2.z ose-openshift-controller-manager-container security update
    • Red Hat OpenShift Container Platform 4.2 openshift4/ose-openshift-controller-manager-rhel7
  • RHSA-2020:2992 Released 2020-07-27 · Red Hat rating Moderate
    OpenShift Container Platform 3.11 security update
    • Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-redistributable-3.11.248-1.git.0.92ee8ac.el7 +12
  • RHSA-2020:2927 Released 2020-07-21 · Red Hat rating Moderate
    OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update
    • Red Hat OpenShift Container Platform 4.4 machine-config-daemon-4.4.0-202007092124.p0.git.2349.08d34d1.el8, openshift-4.4.0-202007090832.p0.git.0.bc32fb1.el7, openshift-4.4.0-202007090832.p0.git.0.bc32fb1.el8 +2
Show 16 more Red Hat advisories
  • RHSA-2020:2413 Released 2020-07-13 · Red Hat rating Moderate
    OpenShift Container Platform 4.5 package security update
    • Red Hat OpenShift Container Platform 4.5 machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el8 +2
  • RHSA-2020:2027 Released 2020-05-13 · Red Hat rating Moderate
    OpenShift Container Platform 4.2.33 openshift-clients security update
    • Red Hat OpenShift Container Platform 4.2 openshift-clients-4.2.32-202005020632.git.1.1b0fab9.el8, openshift-clients-redistributable-4.2.32-202005020632.git.1.1b0fab9.el8
  • RHSA-2020:2117 Released 2020-05-12 · Red Hat rating Important
    podman security update
    • Red Hat Enterprise Linux 7 Extras podman-1.6.4-18.el7_8, podman-docker-1.6.4-18.el7_8
  • RHSA-2020:1940 Released 2020-05-04 · Red Hat rating Moderate
    OpenShift Container Platform 4.4.3 ose-cluster-policy-controller-container security update
    • Red Hat OpenShift Container Platform 4.4 openshift4/ose-cluster-policy-controller-rhel7
  • RHSA-2020:1937 Released 2020-05-04 · Red Hat rating Moderate
    OpenShift Container Platform 4.4.3 cri-o security update
    • Red Hat OpenShift Container Platform 4.4 cri-o-1.17.4-8.dev.rhaos4.4.git5f5c5e4.el7, cri-o-1.17.4-8.dev.rhaos4.4.git5f5c5e4.el8
  • RHSA-2020:1396 Released 2020-04-14 · Red Hat rating Low
    OpenShift Container Platform 4.3.12 podman security update
    • Red Hat OpenShift Container Platform 4.3 podman-1.6.4-10.rhaos4.3.el8, podman-docker-1.6.4-10.rhaos4.3.el8, podman-manpages-1.6.4-10.rhaos4.3.el8 +2
  • RHSA-2020:1402 Released 2020-04-14 · Red Hat rating Moderate
    OpenShift Container Platform 4.2.28 openshift-enterprise-builder-container security update
    • Red Hat OpenShift Container Platform 4.2 openshift4/ose-docker-builder
  • RHSA-2020:0934 Released 2020-04-01 · Red Hat rating Moderate
    OpenShift Container Platform 4.3.9 ose-openshift-controller-manager-container security update
    • Red Hat OpenShift Container Platform 4.3 openshift4/ose-openshift-controller-manager-rhel7
  • RHSA-2020:1234 Released 2020-04-01 · Red Hat rating Moderate
    docker security and bug fix update
    • Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-161.git64e9980.el7_8, docker-client-2:1.13.1-161.git64e9980.el7_8, docker-common-2:1.13.1-161.git64e9980.el7_8 +5
  • RHSA-2020:1231 Released 2020-04-01 · Red Hat rating Moderate
    buildah security and bug fix update
    • Red Hat Enterprise Linux 7 Extras buildah-1.11.6-8.el7_8
  • RHSA-2020:1230 Released 2020-04-01 · Red Hat rating Moderate
    skopeo security and bug fix update
    • Red Hat Enterprise Linux 7 Extras containers-common-1:0.1.40-7.el7_8, skopeo-1:0.1.40-7.el7_8
  • RHSA-2020:0863 Released 2020-03-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.3.8 proglottis/gpgme security update
    • Red Hat OpenShift Container Platform 4.3 openshift4/ose-cli, openshift4/ose-cli-artifacts, openshift4/ose-docker-builder
  • RHSA-2020:0928 Released 2020-03-24 · Red Hat rating Moderate
    OpenShift Container Platform 4.3.8 openshift-clients security update
    • Red Hat OpenShift Container Platform 4.3 openshift-clients-4.3.7-202003130552.git.0.6027a27.el7, openshift-clients-4.3.7-202003130552.git.0.6027a27.el8, openshift-clients-redistributable-4.3.7-202003130552.git.0.6027a27.el7 +1
  • RHSA-2020:0697 Released 2020-03-12 · Red Hat rating Moderate
    OpenShift Container Platform 4.1.38 skopeo security update
    • Red Hat OpenShift Container Platform 4.1 containers-common-1:0.1.32-6.git1715c90.el8_0, skopeo-1:0.1.32-6.git1715c90.el8_0
  • RHSA-2020:0679 Released 2020-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.3.5 skopeo security update
    • Red Hat OpenShift Container Platform 4.3 containers-common-1:0.1.40-4.rhaos.el8, skopeo-1:0.1.40-4.rhaos.el8, skopeo-tests-1:0.1.40-4.rhaos.el8
  • RHSA-2020:0689 Released 2020-03-10 · Red Hat rating Moderate
    OpenShift Container Platform 4.2.22 skopeo security update
    • Red Hat OpenShift Container Platform 4.2 containers-common-1:0.1.32-7.git1715c90.rhaos4.2.el8, skopeo-1:0.1.32-7.git1715c90.rhaos4.2.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7 ExtrasFixed RHSA-2020:1230, RHSA-2020:1231, RHSA-2020:1234, RHSA-2020:2117
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2020:2992
Red Hat OpenShift Container Platform 4.1Fixed RHSA-2020:0697
Red Hat OpenShift Container Platform 4.2Fixed RHSA-2020:0689, RHSA-2020:1402, RHSA-2020:2027, RHSA-2020:3167
Red Hat OpenShift Container Platform 4.3Fixed RHSA-2020:0679, RHSA-2020:0863, RHSA-2020:0928, RHSA-2020:0934, RHSA-2020:1396
Red Hat OpenShift Container Platform 4.4Fixed RHSA-2020:1937, RHSA-2020:2927
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2020:2413
Red Hat OpenShift Container Platform 4.6Fixed—
Not affected: 6 products
  • Red Hat Ansible Tower 3
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 4.3
  • Red Hat OpenShift Container Platform 4.4
  • Red Hat OpenShift Container Platform 4.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8945
  2. 2026-10-03 Alias added: GHSA-m6wg-2mwg-4rfq
  3. 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.6 · Red Hat

References

Exploit 1

Patch 3

Advisory 8

Other 7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences