CVE-2020-8284

🗓️ 14 Dec 2020 19:38:26Reported by hackeroneType

A malicious server can trick curl 7.73.0 and earlier into making unauthorized connections and extracting private service informatio

Reporter	Title	Published	Views	Family All 195
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Curl affect PowerSC (CVE-2020-8284, CVE-2020-8285, and CVE-2020-8286)	15 Mar 202117:09	–	ibm
IBM Security Bulletins	Security Bulletin: Cloud Pak for Security uses packages that are vulnerable to several CVEs	19 Oct 202115:38	–	ibm
IBM Security Bulletins	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server and Aspera High-Speed Transfer Endpoint 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202116:40	–	ibm
IBM Security Bulletins	Security Bulletin: cURL libcurl vulnerabilites impacting Aspera High-Speed Transfer Server, Aspera High-Speed Transfer Endpoint, Aspera Desktop Client 4.0 and earlier (CVE-2020-8284, CVE-2020-8286, CVE-2020-8285)	4 Jun 202101:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by a vulnerability within libcurl (CVE-2020-8284)	19 May 202111:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM Application Framework Base Image is vulnerable to using components with Known Vulnerabilities	3 Dec 202118:52	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerabilities affect IBM Cloud Private - curl (Multiple CVEs)	22 Apr 202212:50	–	ibm
FreeBSD	cURL -- Multiple vulnerabilities	9 Dec 202000:00	–	freebsd
ATTACKERKB	CVE-2020-8284	14 Dec 202020:15	–	attackerkb
Tenable Nessus	Amazon Linux 2 : curl (ALAS-2021-1693)	6 Aug 202100:00	–	nessus

[
  {
    "product": "https://github.com/curl/curl",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "7.73.0 and earlier"
      }
    ]
  }
]

Source	Link
hackerone	www.hackerone.com/reports/1040166
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
security	www.security.gentoo.org/glsa/202012-14
support	www.support.apple.com/kb/HT212327
oracle	www.oracle.com//security-alerts/cpujul2021.html
cert-portal	www.cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
security	www.security.netapp.com/advisory/ntap-20210122-0007/
curl	www.curl.se/docs/CVE-2020-8284.html
support	www.support.apple.com/kb/HT212326

19 Apr 2022 23:23Current

6.2Medium risk

Vulners AI Score6.2

EPSS0.03851

CWE-200