An update of the curl package has been released.

This update for curl fixes the following issues :

CVE-2020-8286: Fixed improper OSCP verification in the client side (bsc#1179593).

CVE-2020-8285: Fixed a stack overflow due to FTP wildcard (bsc#1179399).

CVE-2020-8284: Fixed an issue where a malicius FTP server could make curl connect to a different IP (bsc#1179398).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- curl: Inferior OCSP verification (CVE-2020-8286)

  - libcurl: FTP wildcard stack overflow (CVE-2020-8285)

  - curl: trusting FTP PASV responses (CVE-2020-8284)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the versions of the curl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities :

  - curl 7.21.0 to and including 7.73.0 is vulnerable to     uncontrolled recursion due to a stack overflow issue in     FTP wildcard match parsing.(CVE-2020-8285)

  - A flaw was found in libcurl from versions 7.29.0     through 7.71.1. An application that performs multiple     requests with libcurl's multi API, and sets the     `CURLOPT_CONNECT_ONLY` option, might experience libcurl     using the wrong connection. The highest threat from     this vulnerability is to data     confidentiality.(CVE-2020-8231)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

On December 9, 2020, curl published security updates addressing CVE-2020-8284, CVE-2020-8285, and CVE-2020-8286. Previous releases of Puppet Agent contain a vulnerable version of curl. For more information about this vulnerability, refer to the security announcement.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is running a version of macOS / Mac OS X that is 10.15.x prior to 10.15.7 Security Update 2021-002 Catalina It is, therefore, affected by multiple vulnerabilities, including the following:

  - An application may be able to execute arbitrary code with system privileges due to insufficient permission     checks (CVE-2020-3838).

  - A memory corruption vulnerability could allow an application read access to restricted memory (CVE-2021-1808).

  - A memory corruption vulnerability could allow an application to cause unexpected system termination or to     write kernel memory (CVE-2021-1828).

Note that Nessus has not tested for this issue but has instead relied only on the operating system's self-reported version number.

The version of curl installed on the remote host is prior to 7.76.1-4. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1693 advisory.

    A flaw was found in libcurl from versions 7.29.0 through 7.71.1. An application that performs multiple     requests with libcurl's multi API, and sets the `CURLOPT_CONNECT_ONLY` option, might experience libcurl     using the wrong connection. The highest threat from this vulnerability is to data confidentiality.
    (CVE-2020-8231)

    A malicious server can use the `PASV` response to trick curl into connecting back to a given IP address     and port, and this way potentially make curl extract information about services that are otherwise private     and not disclosed, for example doing port scanning and service banner extractions. If curl operates on a     URL provided by a user, a user can exploit that and pass in a URL to a malicious FTP server instance     without needing any server breach to perform the attack. (CVE-2020-8284)

    Libcurl offers a wildcard matching functionality, which allows a callback (set with     `CURLOPT_CHUNK_BGN_FUNCTION`) to return information back to libcurl on how to handle a specific entry in a     directory when libcurl iterates over a list of all available entries. When this callback returns     `CURL_CHUNK_BGN_FUNC_SKIP`, to tell libcurl to not deal with that file, the internal function in libcurl     then calls itself recursively to handle the next directory entry. If there's a sufficient amount of file     entries and if the callback returns skip enough number of times, libcurl runs out of stack space. The     exact amount will of course vary with platforms, compilers and other environmental factors.
    (CVE-2020-8285)

    Libcurl offers OCSP stapling via the CURLOPT_SSL_VERIFYSTATUS option. When set, libcurl verifies the     OCSP response that a server responds with as part of the TLS handshake. It then aborts the TLS negotiation     if something is wrong with the response. The same feature can be enabled with --cert-status using the curl     tool. As part of the OCSP response verification, a client should verify that the response is indeed set     out for the correct certificate. This step was not performed by libcurl when built or told to use OpenSSL     as TLS backend. (CVE-2020-8286)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1610 advisory.

  - Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending     data. (CVE-2020-8231)

  - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
    (CVE-2020-8284)

  - curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue     in FTP wildcard match parsing. (CVE-2020-8285)

  - curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to     insufficient verification of the OCSP response. (CVE-2020-8286)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ ciqsa-2026_1401 advisory.

    This advisory aggregates security fixes for the curl SRPM in CIQ LTS 9.6. It addresses 148 CVEs:
    CVE-2023-32001, CVE-2022-27775, CVE-2018-1000005, CVE-2022-27774, CVE-2022-32221, and 143 more.

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Junos OS installed on the remote host is affected by multiple vulnerabilities as referenced in the JSA79108 advisory.

  - This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to     pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting     done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected     to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due     to this bug, the local variable that means let the host resolve the name could get the wrong value     during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target     buffer instead of copying just the resolved address there. The target buffer being a heap based buffer,     and the host name coming from the URL that curl has been told to operate with. (CVE-2023-38545)

  - This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the     specific series of conditions are met. libcurl performs transfers. In its API, an application creates     easy handles that are the individual handles for single transfers. libcurl provides a function call that     duplicates en easy handle called     [curl_easy_duphandle](https://curl.se/libcurl/c/curl_easy_duphandle.html). If a transfer has cookies     enabled when the handle is duplicated, the cookie-enable state is also cloned - but without cloning the     actual cookies. If the source handle did not read any cookies from a specific file on disk, the cloned     version of the handle would instead store the file name as `none` (using the four ASCII letters, no     quotes). Subsequent use of the cloned handle that does not explicitly set a source to load cookies from     would then inadvertently load cookies from a file named `none` - if such a file exists and is readable in     the current directory of the program using libcurl. And if using the correct file format of course.
    (CVE-2023-38546)

  - A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause     HSTS functionality fail when multiple URLs are requested serially. Using its HSTS support, curl can be     instructed to use HTTPS instead of using an insecure clear-text HTTP step even when HTTP is provided in     the URL. This HSTS mechanism would however surprisingly be ignored by subsequent transfers when done on     the same command line because the state would not be properly carried on. (CVE-2023-23914)

  - A cleartext transmission of sensitive information vulnerability exists in curl <v7.88.0 that could cause     HSTS functionality to behave incorrectly when multiple URLs are requested in parallel. Using its HSTS     support, curl can be instructed to use HTTPS instead of using an insecure clear-text HTTP step even when     HTTP is provided in the URL. This HSTS mechanism would however surprisingly fail when multiple transfers     are done in parallel as the HSTS cache file gets overwritten by the most recently completed transfer. A     later HTTP-only transfer to the earlier host name would then *not* get upgraded properly to HSTS.
    (CVE-2023-23915)

  - A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to     a given IP address and port, and this way potentially make curl extract information about services that     are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
    (CVE-2020-8284)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
144069	Photon OS 3.0: Curl PHSA-2020-3.0-0174	Nessus	PhotonOS Local Security Checks	12/10/2020	5/8/2026	high
144094	SUSE SLES12 Security Update : curl (SUSE-SU-2020:3739-1)	Nessus	SuSE Local Security Checks	12/11/2020	5/8/2026	high
144241	Fedora 33 : curl (2020-ceaf490686)	Nessus	Fedora Local Security Checks	12/15/2020	5/8/2026	high
147561	EulerOS Virtualization 3.0.6.6 : curl (EulerOS-SA-2021-1466)	Nessus	Huawei Local Security Checks	3/10/2021	1/10/2024	high
184147	Puppet Agent < 7.1.0 Vulnerability	Nessus	Windows	11/1/2023	11/4/2025	high
149042	macOS 10.15.x < 10.15.7 Security Update 2021-002 Catalina (HT212326)	Nessus	MacOS X Local Security Checks	4/28/2021	5/28/2024	critical
152237	Amazon Linux 2 : curl (ALAS-2021-1693)	Nessus	Amazon Linux Local Security Checks	8/6/2021	5/8/2026	high
185011	Rocky Linux 8 : curl (RLSA-2021:1610)	Nessus	Rocky Linux Local Security Checks	11/7/2023	5/8/2026	high
353701	Rocky Linux 9.6 [CIQ] Security Update: curl / curl-minimal / libcurl / libcurl-devel / libcurl-minimal Multiple Vulnerabilities (ciqsa-2026_1401)	Nessus	Rocky Linux Local Security Checks	10/1/2026	10/13/2026	critical
193216	Juniper Junos OS Multiple Vulnerabilities (JSA79108)	Nessus	Junos Local Security Checks	4/11/2024	11/5/2025	critical

Detections

Analytics

Plugins Search

high

high

high

high

high

critical

high

high

critical

critical