Description
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-proglottis-gpgme | 0.1.1-1 | — |
| Debian 13 | golang-github-proglottis-gpgme | 0.1.1-1 | — |
| Debian 12 | golang-github-proglottis-gpgme | 0.1.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | singularity-container | No fix yet | — |
| Ubuntu 25.10 | singularity-container | No fix yet | — |
| Ubuntu 20.04 LTS | golang-github-proglottis-gpgme | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | singularity-container | No fix yet | — |
| Ubuntu Pro 18.04 LTS | singularity-container | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Extras Other 7 | buildah | 1.11.6-8.el7_8 | RHSA-2020:1231 |
| Red Hat Rhel Extras Other 7 | docker +7 | 2:1.13.1-161.git64e9980.el7_8 | RHSA-2020:1234 |
| Red Hat Rhel Extras Other 7 | podman +1 | 1.6.4-18.el7_8 | RHSA-2020:2117 |
| Red Hat Rhel Extras Other 7 | skopeo +1 | 1:0.1.40-7.el7_8 | RHSA-2020:1230 |
| Red Hat OpenShift 4 | cri-o | 1.16.4-1.dev.rhaos4.3.git9238eee.el7 | RHSA-2020:1937, RHBA-2020:1255 |
| Red Hat OpenShift 4 | machine-config-daemon | 4.4.0-202007092124.p0.git.2349.08d34d1.el8 | RHSA-2020:2927, RHSA-2020:2413 |
| Red Hat OpenShift 4 | openshift +1 | 4.4.0-202007090832.p0.git.0.bc32fb1.el7 | RHSA-2020:2927, RHSA-2020:2413 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.2.32-202005020632.git.1.1b0fab9.el8 | RHSA-2020:2027, RHSA-2020:0928 |
| Red Hat OpenShift 4 | podman +4 | 1.6.4-10.rhaos4.3.el8 | RHSA-2020:1396 |
| Red Hat OpenShift 4 | skopeo +1 | 1:0.1.32-6.git1715c90.el8_0 | RHSA-2020:0697, RHSA-2020:0689, RHSA-2020:0679 |
| Red Hat OpenShift 4 | skopeo-tests | 1:0.1.40-4.rhaos.el8 | RHSA-2020:0679 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.248-1.git.0.92ee8ac.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.248-1.git.1.cc96c2d.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 | RHSA-2020:2992 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/proglottis/gpgme | < 0.1.1 | 0.1.1 | GHSA-m6wg-2mwg-4rfq |
Advisories 16
- RHSA-2020:2413 Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2020:2992 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:2117 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:1396 Red Hat Security Advisory: OpenShift Container Platform 4.3.12 podman security update Red Hat Security Advisories (RHSA) · Aug 8, 2026
- RHSA-2020:1937 Red Hat Security Advisory: OpenShift Container Platform 4.4.3 cri-o security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1234 Red Hat Security Advisory: docker security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2020:1231 Red Hat Security Advisory: buildah security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:1230 Red Hat Security Advisory: skopeo security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:2927 Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:0697 Red Hat Security Advisory: OpenShift Container Platform 4.1.38 skopeo security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:0679 Red Hat Security Advisory: OpenShift Container Platform 4.3.5 skopeo security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:0689 Red Hat Security Advisory: OpenShift Container Platform 4.2.22 skopeo security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHBA-2020:1255 Red Hat Bug Fix Advisory: OpenShift Container Platform 4.3.10 packages update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:2027 Red Hat Security Advisory: OpenShift Container Platform 4.2.33 openshift-clients security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:0928 Red Hat Security Advisory: OpenShift Container Platform 4.3.8 openshift-clients security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- WID-SEC-2022-1089 Red Hat OpenShift Container Platform: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 27, 2025
References
- https://github.com/proglottis/gpgme/pull/23
- https://bugzilla.redhat.com/show_bug.cgi?id=1795838
- https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1
- https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1
- FEDORA-2020-f317e13ecf vendor-advisory
- FEDORA-2020-2a0aac3502 vendor-advisory
- FEDORA-2020-ccc3e64ea5 vendor-advisory
- RHSA-2020:0679 vendor-advisory
- RHSA-2020:0689 vendor-advisory
- RHSA-2020:0697 vendor-advisory
- FEDORA-2020-aeea04cd13 vendor-advisory