CVE-2020-8284

Name
CVE-2020-8284
Description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
NVD Severity
unknown
Other trackers
Mailing lists
Exploits
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
Permissions Required https://hackerone.com/reports/1040166
Vendor Advisory https://curl.se/docs/CVE-2020-8284.html
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
Mailing List https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
Third Party Advisory https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
GENTOO https://security.gentoo.org/glsa/202012-14
CONFIRM https://security.netapp.com/advisory/ntap-20210122-0007/
DEBIAN https://www.debian.org/security/2021/dsa-4881
CONFIRM https://support.apple.com/kb/HT212325
CONFIRM https://support.apple.com/kb/HT212326
CONFIRM https://support.apple.com/kb/HT212327
MISC https://www.oracle.com/security-alerts/cpuApr2021.html
Patch https://www.oracle.com//security-alerts/cpujul2021.html
Patch https://www.oracle.com/security-alerts/cpujan2022.html
Third Party Advisory https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
MISC https://www.oracle.com/security-alerts/cpuapr2022.html
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
Mailing List https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:* curl >= None <= 7.73.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
curl 3.10-main 7.66.0-r4 Natanael Copa <ncopa@alpinelinux.org> possibly vulnerable