Detections
Analytics
CVE-2020-8284
low
Description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
References
https://www.oracle.com/security-alerts/cpujan2022.html
https://www.oracle.com/security-alerts/cpuapr2022.html
https://www.oracle.com/security-alerts/cpuApr2021.html
https://www.oracle.com//security-alerts/cpujul2021.html
https://www.debian.org/security/2021/dsa-4881
https://support.apple.com/kb/HT212327
https://support.apple.com/kb/HT212326
https://support.apple.com/kb/HT212325
https://security.netapp.com/advisory/ntap-20210122-0007/
https://security.gentoo.org/glsa/202012-14
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
https://github.com/Live-Hack-CVE/CVE-2021-40491
https://hackerone.com/reports/1040166
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29152
https://curl.se/docs/CVE-2020-8284.html
https://cert-portal.siemens.com/productcert/html/ssa-398330.html
https://cert-portal.siemens.com/productcert/html/ssa-389290.html