CVE-2020-8169: Infoleak
A flaw was found in libcurl. A part of a password may be prepended to the host name before the host name is resolved, leading to a leak of the partial password over the network and to DNS servers. This highest threat from this vulnerability is to data confidentiality.
Other sources
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
libcurl can be tricked to prepend a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s).
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2020-8169?
CVE-2020-8169 is an information disclosure vulnerability found in libcurl.
How does CVE-2020-8169 affect data confidentiality?
CVE-2020-8169 poses a high threat to data confidentiality.
Which software versions are affected by CVE-2020-8169?
curl versions 7.62.0 through 7.70.0 are vulnerable to CVE-2020-8169.
How can I fix CVE-2020-8169?
To fix CVE-2020-8169, update curl to version 7.71.0 or higher.
Where can I find more information about CVE-2020-8169?
You can find more information about CVE-2020-8169 on the official CVE page and the Red Hat bugzilla page.