Vulnerability · Published Dec 14, 2020 · Assigned by hackerone
CVE-2020-8286
High 7.5
In plain English
A high-severity improper certificate validation in https://github.com/curl/curl. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.6%top 8.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8286 |
| Alpine:v3.21 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8286 |
| Alpine:v3.22 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8286 |
| Alpine:v3.23 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8286 |
| Alpine:v3.24 | curl | 7.74.0-r0 | ALPINE-CVE-2020-8286 |
| Debian:12 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8286 |
| Debian:13 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8286 |
| Debian:14 | curl | 7.74.0-1 | DEBIAN-CVE-2020-8286 |
| Rocky Linux:8 | curl | 0:7.61.1-18.el8 | RLSA-2021:1610 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/curl/curl | 7.41.0 to and including 7.73.0 |
Weakness: CWE-295
References
- https://hackerone.com/reports/1048457 x_refsource_MISC
- https://curl.se/docs/CVE-2020-8286.html x_refsource_MISC
- FEDORA-2020-ceaf490686 vendor-advisory, x_refsource_FEDORA
- [debian-lts-announce] 20201219 [SECURITY] [DLA 2500-1] curl security update mailing-list, x_refsource_MLIST
- FEDORA-2020-7ab62c73bc vendor-advisory, x_refsource_FEDORA
- GLSA-202012-14 vendor-advisory, x_refsource_GENTOO
- DSA-4881 vendor-advisory, x_refsource_DEBIAN
- 20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina mailing-list, x_refsource_FULLDISC
- 20210427 APPLE-SA-2021-04-26-2 macOS Big Sur 11.3 mailing-list, x_refsource_FULLDISC
- 20210427 APPLE-SA-2021-04-26-4 Security Update 2021-003 Mojave mailing-list, x_refsource_FULLDISC
- https://www.oracle.com/security-alerts/cpuApr2021.html x_refsource_MISC
- https://security.netapp.com/advisory/ntap-20210122-0007/ x_refsource_CONFIRM
- https://support.apple.com/kb/HT212325 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212326 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212327 x_refsource_CONFIRM
- https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf x_refsource_CONFIRM
- https://www.oracle.com//security-alerts/cpujul2021.html x_refsource_MISC
- https://www.oracle.com/security-alerts/cpuapr2022.html x_refsource_MISC
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf x_refsource_CONFIRM
- https://cert-portal.siemens.com/productcert/html/ssa-200951.html
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html