CVE-2020-8286High· 7.5▾ Twilightcurl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.9 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.6%
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
libcurl >= 7.41.0, < 7.74.0fedora = 32fedora = 33debian_linux = 9.0debian_linux = 10.0clustered_data_ontaphci_management_nodesolidfirehci_bootstrap_oshci_storage_node_firmwaremac_os_x < 10.14.6mac_os_x >= 10.15, < 10.15.7mac_os_x = 10.14.6mac_os_x = 10.15.7macos >= 11.0, < 11.3simatic_tim_1531_irc_firmware <= 2.2sinec_infrastructure_network_services < 1.0.1.1communications_billing_and_revenue_management = 12.0.0.3.0communications_cloud_native_core_policy = 1.14.0essbase = 21.2peoplesoft_enterprise_peopletools = 8.58universal_forwarder >= 8.2.0, < 8.2.12universal_forwarder >= 9.0.0, < 9.0.6universal_forwarder = 9.1.0Upgrade past the affected range:
libcurl 7.74.0mac_os_x 10.15.7macos 11.3sinec_infrastructure_network_services 1.0.1.1universal_forwarder 9.0.6Connected by shared product, vendor, weakness, or advisory.
CVE-2020-8285High· 7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2020-8231High· 7.5Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
CVE-2020-8284Low· 3.7A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and n…
CVE-2020-8177High· 7.8curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.
CVE-2020-8169High· 7.5curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
CVE-2021-22901High· 8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection