CVE-2020-8285
High
Description
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Haxx Libcurl
PublishedDec 14, 2020
First seenDec 14, 2020
Weakness typeCWE-674CWE-674
How to fix
Update
- haxx libcurl7.74.0 or later
- apple mac_os_x10.14.6, 10.15.7 or later
- apple macos11.3 or later
- fujitsu m10-1_firmwarexcp2410, xcp3110 or later
- fujitsu m10-4_firmwarexcp2410, xcp3110 or later
- fujitsu m10-4s_firmwarexcp2410, xcp3110 or later
- fujitsu m12-1_firmwarexcp2410, xcp3110 or later
- fujitsu m12-2_firmwarexcp2410, xcp3110 or later
- fujitsu m12-2s_firmwarexcp2410, xcp3110 or later
- siemens sinec_infrastructure_network_services1.0.1.1 or later
- splunk universal_forwarder8.2.12, 9.0.6 or later
Vendor advisories
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- security.gentoo.org/glsa/202012-14
- debian.org/security/2021/dsa-4881
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| haxx libcurl | 7.21.0 ≤ v < 7.74.0 | 7.74.0 |
| debian debian_linux | 9.0, 10.0 | — |
| fedoraproject fedora | 32, 33 | — |
| netapp clustered_data_ontap | No range specified | — |
| netapp hci_management_node | No range specified | — |
| netapp solidfire | No range specified | — |
| netapp hci_bootstrap_os | No range specified | — |
| netapp hci_storage_node_firmware | No range specified | — |
| apple mac_os_x | v < 10.14.6, 10.15 ≤ v < 10.15.7, 10.14.6, 10.15.7 | 10.14.6, 10.15.7 |
| apple macos | 11.0 ≤ v < 11.3 | 11.3 |
| oracle communications_billing_and_revenue_management | 12.0.0.3.0 | — |
| oracle communications_cloud_native_core_policy | 1.14.0 | — |
| oracle essbase | 21.2 | — |
| oracle peoplesoft_enterprise_peopletools | 8.58 | — |
| fujitsu m10-1_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m10-4_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m10-4s_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-1_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-2_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| fujitsu m12-2s_firmware | v < xcp2410, v < xcp3110 | xcp2410, xcp3110 |
| siemens sinec_infrastructure_network_services | v < 1.0.1.1 | 1.0.1.1 |
| splunk universal_forwarder | 8.2.0 ≤ v < 8.2.12, 9.0.0 ≤ v < 9.0.6, 9.1.0 | 8.2.12, 9.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.