CVE-2020-8284
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
- Score
- CVSS 3.1 3.7 Low
- Status
- Modified - support@hackerone.com
- Published
- 2020-12-14
- Last modified
- 2026-10-14
- Weaknesses
- CWE-200
Affected products
- Mac Os X (Apple)
- Macos (Apple)
- Debian Linux (Debian)
- Fedora (Fedoraproject)
- M10-1 Firmware (Fujitsu)
- M10-4 Firmware (Fujitsu)
- M10-4s Firmware (Fujitsu)
- M12-1 Firmware (Fujitsu)
- M12-2 Firmware (Fujitsu)
- M12-2s Firmware (Fujitsu)
- Curl (Haxx)
- Clustered Data Ontap (Netapp)
- Hci Bootstrap Os (Netapp)
- Hci Management Node (Netapp)
- Hci Storage Node (Netapp)
- Solidfire (Netapp)
- Communications Billing And Revenue Management (Oracle)
- Communications Cloud Native Core Policy (Oracle)
- Essbase (Oracle)
- Peoplesoft Enterprise Peopletools (Oracle)
- Simatic S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
- Simatic S7-1500 Cpu 1518f-4 Pndp Mfp (Siemens)
- Sinec Infrastructure Network Services (Siemens)
- Siplus S7-1500 Cpu 1518-4 Pndp Mfp (Siemens)
- Universal Forwarder (Splunk)
References
- https://hackerone.com/reports/1040166
- https://curl.se/docs/CVE-2020-8284.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2…
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75…
- https://security.gentoo.org/glsa/202012-14
- https://www.debian.org/security/2021/dsa-4881
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210122-0007/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
