--- id: CVE-2020-8284 title: >- A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n… summary: >- A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n… severity: low cvss: 3.7 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N' cwe: - CWE-200 vendor: haxx product: curl affected: - curl <= 7.73.0 - fedora = 32 - fedora = 33 - debian_linux = 9.0 - debian_linux = 10.0 - clustered_data_ontap - hci_management_node - solidfire - hci_storage_node - hci_bootstrap_os - 'mac_os_x >= 10.14.0, < 10.14.6' - 'mac_os_x >= 10.15, < 10.15.7' - mac_os_x = 10.14.6 - mac_os_x = 10.15.7 - macos = 11.0.1 - macos = 11.1 - macos = 11.2 - communications_billing_and_revenue_management = 12.0.0.3.0 - communications_cloud_native_core_policy = 1.14.0 - essbase = 21.2 - peoplesoft_enterprise_peopletools = 8.58 - m10-1_firmware < xcp2410 - m10-4_firmware < xcp2410 - m10-4s_firmware < xcp2410 - m12-1_firmware < xcp2410 - m12-2_firmware < xcp2410 - m12-2s_firmware < xcp2410 - m10-1_firmware < xcp3110 - m10-4_firmware < xcp3110 - m10-4s_firmware < xcp3110 - m12-1_firmware < xcp3110 - m12-2_firmware < xcp3110 - m12-2s_firmware < xcp3110 - sinec_infrastructure_network_services < 1.0.1.1 - 'universal_forwarder >= 8.2.0, < 8.2.12' - 'universal_forwarder >= 9.0.0, < 9.0.6' - universal_forwarder = 9.1.0 patched: - mac_os_x 10.15.7 - m10-1_firmware xcp3110 - m10-4_firmware xcp3110 - m10-4s_firmware xcp3110 - m12-1_firmware xcp3110 - m12-2_firmware xcp3110 - m12-2s_firmware xcp3110 - sinec_infrastructure_network_services 1.0.1.1 - universal_forwarder 9.0.6 published: '2020-12-14' updated: '2026-10-14' sourceUpdated: '2026-10-14T09:17:20.200' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-8284' references: - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: support@hackerone.com - url: 'https://curl.se/docs/CVE-2020-8284.html' label: support@hackerone.com - url: 'https://hackerone.com/reports/1040166' label: support@hackerone.com - url: 'https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html' label: support@hackerone.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ label: support@hackerone.com - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ label: support@hackerone.com - url: 'https://security.gentoo.org/glsa/202012-14' label: support@hackerone.com - url: 'https://security.netapp.com/advisory/ntap-20210122-0007/' label: support@hackerone.com - url: 'https://support.apple.com/kb/HT212325' label: support@hackerone.com - url: 'https://support.apple.com/kb/HT212326' label: support@hackerone.com - url: 'https://support.apple.com/kb/HT212327' label: support@hackerone.com - url: 'https://www.debian.org/security/2021/dsa-4881' label: support@hackerone.com - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: support@hackerone.com - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: support@hackerone.com - url: 'https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://curl.se/docs/CVE-2020-8284.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://hackerone.com/reports/1040166' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ label: af854a3a-2127-422b-91ae-364da2661108 - url: >- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.gentoo.org/glsa/202012-14' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://security.netapp.com/advisory/ntap-20210122-0007/' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212325' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212326' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://support.apple.com/kb/HT212327' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.debian.org/security/2021/dsa-4881' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com//security-alerts/cpujul2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuApr2021.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpuapr2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://www.oracle.com/security-alerts/cpujan2022.html' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-389290.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e tags: - nvd epss: 0.03898 epssPercentile: 0.9004 ingestedAt: '2026-10-14T09:24:26.058Z' --- ## Overview A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. ## Affected - `curl <= 7.73.0` - `fedora = 32` - `fedora = 33` - `debian_linux = 9.0` - `debian_linux = 10.0` - `clustered_data_ontap` - `hci_management_node` - `solidfire` - `hci_storage_node` - `hci_bootstrap_os` - `mac_os_x >= 10.14.0, < 10.14.6` - `mac_os_x >= 10.15, < 10.15.7` - `mac_os_x = 10.14.6` - `mac_os_x = 10.15.7` - `macos = 11.0.1` - `macos = 11.1` - `macos = 11.2` - `communications_billing_and_revenue_management = 12.0.0.3.0` - `communications_cloud_native_core_policy = 1.14.0` - `essbase = 21.2` - `peoplesoft_enterprise_peopletools = 8.58` - `m10-1_firmware < xcp2410` - `m10-4_firmware < xcp2410` - `m10-4s_firmware < xcp2410` - `m12-1_firmware < xcp2410` - `m12-2_firmware < xcp2410` - `m12-2s_firmware < xcp2410` - `m10-1_firmware < xcp3110` - `m10-4_firmware < xcp3110` - `m10-4s_firmware < xcp3110` - `m12-1_firmware < xcp3110` - `m12-2_firmware < xcp3110` - `m12-2s_firmware < xcp3110` - `sinec_infrastructure_network_services < 1.0.1.1` - `universal_forwarder >= 8.2.0, < 8.2.12` - `universal_forwarder >= 9.0.0, < 9.0.6` - `universal_forwarder = 9.1.0` ## Remediation Upgrade past the affected range: - `mac_os_x 10.15.7` - `m10-1_firmware xcp3110` - `m10-4_firmware xcp3110` - `m10-4s_firmware xcp3110` - `m12-1_firmware xcp3110` - `m12-2_firmware xcp3110` - `m12-2s_firmware xcp3110` - `sinec_infrastructure_network_services 1.0.1.1` - `universal_forwarder 9.0.6`