Vulnerability · Published Dec 14, 2020 · Assigned by hackerone
CVE-2020-8284
Low 3.7
In plain English
A low-severity information exposure in https://github.com/curl/curl. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 3.9% (higher than 90% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8284 |
| Alpine:v3.21 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8284 |
| Alpine:v3.22 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8284 |
| Alpine:v3.23 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8284 |
| Alpine:v3.24 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8284 |
| Debian:12 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8284 |
| Debian:13 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8284 |
| Debian:14 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8284 |
| Rocky Linux:8 | curl | 0:7.61.1-18.el8 | RLSA-2021:1610 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | 7.73.0 and earlier |
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://hackerone.com/reports/1040166 x_refsource_MISC
- https://curl.se/docs/CVE-2020-8284.html x_refsource_MISC
- FEDORA-2020-ceaf490686 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20201219 [SECURITY] [DLA 2500-1] curl security update mailing-list, x_refsource_MLIST
- FEDORA-2020-7ab62c73bc vendor-advisory, x_refsource_FEDORA
- GLSA-202012-14 vendor-advisory, x_refsource_GENTOO
- DSA-4881 vendor-advisory, x_refsource_DEBIAN
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210122-0007/ x_refsource_CONFIRM
- https://support.apple.com/kb/HT212325 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212326 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212327 x_refsource_CONFIRM
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpujan2022.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html