CVE-2020-8169: Infoleak

Q: What is CVE-2020-8169?

CVE-2020-8169 is an information disclosure vulnerability found in libcurl.

Q: How does CVE-2020-8169 affect data confidentiality?

CVE-2020-8169 poses a high threat to data confidentiality.

Q: Which software versions are affected by CVE-2020-8169?

curl versions 7.62.0 through 7.70.0 are vulnerable to CVE-2020-8169.

Q: How can I fix CVE-2020-8169?

To fix CVE-2020-8169, update curl to version 7.71.0 or higher.

Q: Where can I find more information about CVE-2020-8169?

You can find more information about CVE-2020-8169 on the official CVE page and the Red Hat bugzilla page.

Published Jun 17, 2020

Updated

A flaw was found in libcurl. A part of a password may be prepended to the host name before the host name is resolved, leading to a leak of the partial password over the network and to DNS servers. This highest threat from this vulnerability is to data confidentiality.

Other sources

curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).

libcurl can be tricked to prepend a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s).

— Red Hat

Affected Software

30 affected componentsFixes available

redhat/jbcs-httpd24<0:1-18.el8

0:1-18.el8

redhat/jbcs-httpd24-apr<0:1.6.3-105.el8

0:1.6.3-105.el8

redhat/jbcs-httpd24-apr-util<0:1.6.1-82.el8

0:1.6.1-82.el8

redhat/jbcs-httpd24-brotli<0:1.0.6-40.el8

0:1.0.6-40.el8

redhat/jbcs-httpd24-curl<0:7.77.0-2.el8

0:7.77.0-2.el8

redhat/jbcs-httpd24-httpd<0:2.4.37-74.el8

0:2.4.37-74.el8

redhat/jbcs-httpd24-jansson<0:2.11-55.el8

0:2.11-55.el8

redhat/jbcs-httpd24-nghttp2<0:1.39.2-37.el8

0:1.39.2-37.el8

redhat/jbcs-httpd24-openssl<1:1.1.1g-6.el8

1:1.1.1g-6.el8

redhat/jbcs-httpd24-openssl-chil<0:1.0.0-5.el8

0:1.0.0-5.el8

redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-20.el8

0:0.4.10-20.el8

redhat/jbcs-httpd24<0:1-18.jbcs.el7

0:1-18.jbcs.el7

redhat/jbcs-httpd24-apr<0:1.6.3-105.jbcs.el7

0:1.6.3-105.jbcs.el7

redhat/jbcs-httpd24-apr-util<0:1.6.1-82.jbcs.el7

0:1.6.1-82.jbcs.el7

redhat/jbcs-httpd24-curl<0:7.77.0-2.jbcs.el7

0:7.77.0-2.jbcs.el7

redhat/jbcs-httpd24-httpd<0:2.4.37-74.jbcs.el7

0:2.4.37-74.jbcs.el7

redhat/jbcs-httpd24-jansson<0:2.11-55.jbcs.el7

0:2.11-55.jbcs.el7

debian/curl

7.64.0-4+deb10u27.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2

debian/curl<=7.64.0-4+deb10u1, <=7.64.0-1, <=7.68.0-1

redhat/curl<7.71.0

7.71.0

haxx curl>=7.62.0<=7.70.0

All of the following

Siemens Simatic Tim 1531 Irc Firmware<2.2

Siemens Simatic Tim 1531 Irc

Debian Debian Linux=10.0

Siemens Sinec Infrastructure Network Services<1.0.1.1

Splunk Universal Forwarder>=8.2.0<8.2.12

Splunk Universal Forwarder>=9.0.0<9.0.6

Splunk Universal Forwarder=9.1.0

Siemens Simatic Tim 1531 Irc Firmware<2.2

Siemens Simatic Tim 1531 Irc

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.
Fixed in 0:1-18.el8
Upgrade
Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.
Fixed in 0:1.6.3-105.el8
Upgrade
Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.
Fixed in 0:1.6.1-82.el8
Upgrade
Upgrade redhat/jbcs-httpd24-brotli to a version that resolves this vulnerability.
Fixed in 0:1.0.6-40.el8
Upgrade
Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.
Fixed in 0:7.77.0-2.el8
Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-74.el8
Upgrade
Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.
Fixed in 0:2.11-55.el8
Upgrade
Upgrade redhat/jbcs-httpd24-nghttp2 to a version that resolves this vulnerability.
Fixed in 0:1.39.2-37.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.
Fixed in 1:1.1.1g-6.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-chil to a version that resolves this vulnerability.
Fixed in 0:1.0.0-5.el8
Upgrade
Upgrade redhat/jbcs-httpd24-openssl-pkcs11 to a version that resolves this vulnerability.
Fixed in 0:0.4.10-20.el8
Upgrade
Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.
Fixed in 0:1-18.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.
Fixed in 0:1.6.3-105.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.
Fixed in 0:1.6.1-82.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.
Fixed in 0:7.77.0-2.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.
Fixed in 0:2.4.37-74.jbcs.el7
Upgrade
Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.
Fixed in 0:2.11-55.jbcs.el7
Upgrade
Upgrade debian/curl to a version that resolves this vulnerability.
Fixed in 7.64.0-4+deb10u2Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2
Upgrade
Upgrade redhat/curl to a version that resolves this vulnerability.
Fixed in 7.71.0

Event History

Jun 24, 2020

CVE Published

12:00 AM

Dec 14, 2020

CVE Published

via MITRE·07:41 PM

Data Sourced

via MITRE·07:41 PM

DescriptionWeakness

Data Sourced

via NVD·08:15 PM

RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

What is CVE-2020-8169?