Use After Free (UAF)

2020-02-1305:13:18

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.012 Low

EPSS

Percentile

85.0%

JSON

github.com/proglottis/gpgme is vulnerable to use-after-free. The attack is possible because it allows malicious use for container image pulls by Docker or CRI-O, leading to an application crash or arbitrary code execution during GPG signature verification.

CPENameOperatorVersion
github.com/proglottis/gpgmeeqHEAD
github.com/proglottis/gpgmeeq0.1.0
podmaneq0.11.1.1__3.git594495d.el7.centos
podmaneq1.0.2__1.dev.git96ccc2e.el8
podmaneq1.0.0__3.git921f98f.el7
podmaneq0.9.2__5.git37a2afe.el7_5
podmaneq0.4.1__4.gitb51d327.el7
podmaneq0.6.1__3.git3e0ff12.el7
podmaneq1.2__2.git3bd528e.el7
podmaneq1.4.4__2.el7.centos

Name	Operator	Version
github.com/proglottis/gpgme	eq	HEAD
github.com/proglottis/gpgme	eq	0.1.0
podman	eq	0.11.1.1__3.git594495d.el7.centos
podman	eq	1.0.2__1.dev.git96ccc2e.el8
podman	eq	1.0.0__3.git921f98f.el7
podman	eq	0.9.2__5.git37a2afe.el7_5
podman	eq	0.4.1__4.gitb51d327.el7
podman	eq	0.6.1__3.git3e0ff12.el7
podman	eq	1.2__2.git3bd528e.el7
podman	eq	1.4.4__2.el7.centos