The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.

The remote Redhat Enterprise Linux 8 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1396 advisory.

  - buildah: Crafted input tar file may lead to local file overwrite during image build process     (CVE-2020-10696)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2992 advisory.

  - cri-o: infra container reparented to systemd following OOM Killer killing it's conmon (CVE-2019-14891)

  - nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a     constructor or __proto__ payload (CVE-2020-7598)

  - kubernetes: Use of unbounded 'client' label in apiserver_request_total allows for memory exhaustion     (CVE-2020-8552)

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

  - openshift/console: text injection on error page via crafted url (CVE-2020-10715)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

- Security fix for CVE-2020-8551, CVE-2020-8552,     CVE-2020-8555, CVE-2020-8945

  - Rebase to head of usptream 3.11 branch

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2927 advisory.

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2413 advisory.

  - kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events     for AzureFile and CephFS volumes (CVE-2019-11252)

  - kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)

  - kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

  - golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic (CVE-2020-9283)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:2027 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:2117 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

  - buildah: Crafted input tar file may lead to local file overwrite during image build process     (CVE-2020-10696)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:1937 advisory.

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 / 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0928 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1231 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:1234 advisory.

  - runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)

  - containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1230 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the iSulad-kit package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - The proglottis Go wrapper before 0.1.1 for the GPGME     library has a use-after-free, as demonstrated by use     for container image pulls by Docker or CRI-O. This     leads to a crash or potential code execution during GPG     signature verification.(CVE-2020-8945)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0697 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0689 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:0679 advisory.

  - proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

use crun only for f31+

----

Suggests: crun for f30

----

bump to v1.8.0, Security fix for CVE-2020-8945

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Resolves: #1795838, #1802904 - Security fix for CVE-2020-8945

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
196593	RHEL 8 : proglottis_gpgme (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	high
170288	RHEL 8 : OpenShift Container Platform 4.3.12 podman (RHSA-2020:1396)	Nessus	Red Hat Local Security Checks	high
139006	RHEL 7 : OpenShift Container Platform 3.11 (RHSA-2020:2992)	Nessus	Red Hat Local Security Checks	high
138918	Fedora 32 : origin (2020-aeea04cd13)	Nessus	Fedora Local Security Checks	high
138765	RHEL 7 / 8 : OpenShift Container Platform 4.4.13 machine-config-daemon and openshift (RHSA-2020:2927)	Nessus	Red Hat Local Security Checks	high
138387	RHEL 7 / 8 : OpenShift Container Platform 4.5 package (RHSA-2020:2413)	Nessus	Red Hat Local Security Checks	high
136585	RHEL 8 : OpenShift Container Platform 4.2.33 openshift-clients (RHSA-2020:2027)	Nessus	Red Hat Local Security Checks	high
136522	RHEL 7 : podman (RHSA-2020:2117)	Nessus	Red Hat Local Security Checks	high
136320	RHEL 7 / 8 : OpenShift Container Platform 4.4.3 cri-o (RHSA-2020:1937)	Nessus	Red Hat Local Security Checks	high
135230	RHEL 7 / 8 : OpenShift Container Platform 4.3.8 openshift-clients (RHSA-2020:0928)	Nessus	Red Hat Local Security Checks	high
135085	RHEL 7 : buildah (RHSA-2020:1231)	Nessus	Red Hat Local Security Checks	high
135084	RHEL 7 : docker (RHSA-2020:1234)	Nessus	Red Hat Local Security Checks	high
135082	RHEL 7 : skopeo (RHSA-2020:1230)	Nessus	Red Hat Local Security Checks	high
134782	EulerOS 2.0 SP8 : iSulad-kit (EulerOS-SA-2020-1290)	Nessus	Huawei Local Security Checks	high
134558	RHEL 8 : OpenShift Container Platform 4.1.38 skopeo (RHSA-2020:0697)	Nessus	Red Hat Local Security Checks	high
134392	RHEL 8 : OpenShift Container Platform 4.2.22 skopeo (RHSA-2020:0689)	Nessus	Red Hat Local Security Checks	high
134389	RHEL 8 : OpenShift Container Platform 4.3.5 skopeo (RHSA-2020:0679)	Nessus	Red Hat Local Security Checks	high
134355	Fedora 30 : 2:podman (2020-ccc3e64ea5)	Nessus	Fedora Local Security Checks	high
133891	Fedora 31 : 1:skopeo (2020-f317e13ecf)	Nessus	Fedora Local Security Checks	high
133883	Fedora 30 : 1:skopeo (2020-2a0aac3502)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2020-8945

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high