| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/proglottis/gpgme | < 0.1.1 | 0.1.1 |
| gpgme | < 0.1.1 | 0.1.1 |
| openshift container platform | = 3.11= 4.1= 4.2= 4.3= 4.4= 4.5 | |
| openshift container platform for ibm z | = 4.1= 4.2 | |
| openshift container platform for linuxone | = 4.1= 4.2 |
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free