CVE-2020-8284: Infoleak

Published Nov 30, 2020
·
Updated

A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If curl operates on a URL provided by a user (which by all means is an unwise setup), a user can exploit that and pass in a URL to a malicious FTP server instance without needing any server breach to perform the attack.

Other sources

A malicious server can use the PASV response to trick curl into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions. If curl operates on a URL provided by a user, a user can exploit that and pass in a URL to a malicious FTP server instance without needing any server breach to perform the attack.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

cURL libcurl could allow a remote attacker to obtain sensitive information, caused by improper validation of FTP PASV responses. By persuading a victim to connect a specially-crafted server, an attacker could exploit this vulnerability to obtain sensitive information about services, and use this information to launch further attacks against the affected system.

— IBM

curl. This issue was addressed with improved checks.

Credit

Marian Rehak, Marian Rehak, Marian Rehak

Affected Software

119 affected componentsFixes available
redhat/jbcs-httpd24<0:1-18.el8
0:1-18.el8
redhat/jbcs-httpd24-apr<0:1.6.3-105.el8
0:1.6.3-105.el8
redhat/jbcs-httpd24-apr-util<0:1.6.1-82.el8
0:1.6.1-82.el8
redhat/jbcs-httpd24-brotli<0:1.0.6-40.el8
0:1.0.6-40.el8
redhat/jbcs-httpd24-curl<0:7.77.0-2.el8
0:7.77.0-2.el8
redhat/jbcs-httpd24-httpd<0:2.4.37-74.el8
0:2.4.37-74.el8
redhat/jbcs-httpd24-jansson<0:2.11-55.el8
0:2.11-55.el8
redhat/jbcs-httpd24-nghttp2<0:1.39.2-37.el8
0:1.39.2-37.el8
redhat/jbcs-httpd24-openssl<1:1.1.1g-6.el8
1:1.1.1g-6.el8
redhat/jbcs-httpd24-openssl-chil<0:1.0.0-5.el8
0:1.0.0-5.el8
redhat/jbcs-httpd24-openssl-pkcs11<0:0.4.10-20.el8
0:0.4.10-20.el8
redhat/jbcs-httpd24<0:1-18.jbcs.el7
0:1-18.jbcs.el7
redhat/jbcs-httpd24-apr<0:1.6.3-105.jbcs.el7
0:1.6.3-105.jbcs.el7
redhat/jbcs-httpd24-apr-util<0:1.6.1-82.jbcs.el7
0:1.6.1-82.jbcs.el7
redhat/jbcs-httpd24-curl<0:7.77.0-2.jbcs.el7
0:7.77.0-2.jbcs.el7
redhat/jbcs-httpd24-httpd<0:2.4.37-74.jbcs.el7
0:2.4.37-74.jbcs.el7
redhat/jbcs-httpd24-jansson<0:2.11-55.jbcs.el7
0:2.11-55.jbcs.el7
redhat/curl<0:7.61.1-18.el8
0:7.61.1-18.el8
debian/curl
7.64.0-4+deb10u27.64.0-4+deb10u77.74.0-1.3+deb11u97.74.0-1.3+deb11u107.88.1-10+deb12u37.88.1-10+deb12u48.4.0-2
debian/curl<=7.72.0-1, <=7.64.0-4+deb10u1, <=7.64.0-4
redhat/curl<7.74.0
7.74.0
Apple macOS Big Sur<11.3
11.3
Apple Catalina
Apple Mojave
IBM Cloud Pak for Security (CP4S)<=1.7.2.0
IBM Cloud Pak for Security (CP4S)<=1.7.1.0
IBM Cloud Pak for Security (CP4S)<=1.7.0.0
haxx curl<=7.73.0
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Debian Debian Linux=9.0
Debian Debian Linux=10.0
NetApp Clustered Data ONTAP
NetApp Hci Management Node
NetApp Solidfire
NetApp Hci Storage Node
All of the following
NetApp Hci Bootstrap Os
NetApp Hci Compute Node
Apple iOS and macOS>=10.14.0<10.14.6
Apple iOS and macOS>=10.15<10.15.7
Apple iOS and macOS=10.14.6-security_update_2019-001
Apple iOS and macOS=10.14.6-security_update_2019-002
Apple iOS and macOS=10.14.6-security_update_2019-004
Apple iOS and macOS=10.14.6-security_update_2019-005
Apple iOS and macOS=10.14.6-security_update_2019-006
Apple iOS and macOS=10.14.6-security_update_2019-007
Apple iOS and macOS=10.14.6-security_update_2020-001
Apple iOS and macOS=10.14.6-security_update_2020-002
Apple iOS and macOS=10.14.6-security_update_2020-003
Apple iOS and macOS=10.14.6-security_update_2020-004
Apple iOS and macOS=10.14.6-security_update_2020-005
Apple iOS and macOS=10.14.6-security_update_2020-006
Apple iOS and macOS=10.14.6-security_update_2020-007
Apple iOS and macOS=10.14.6-security_update_2021-001
Apple iOS and macOS=10.14.6-security_update_2021-002
Apple iOS and macOS=10.14.6-supplemental_update
Apple iOS and macOS=10.14.6-supplemental_update_2
Apple iOS and macOS=10.15.7
Apple iOS and macOS=10.15.7-security_update_2020
Apple iOS and macOS=10.15.7-security_update_2020-001
Apple iOS and macOS=10.15.7-security_update_2020-005
Apple iOS and macOS=10.15.7-security_update_2020-007
Apple iOS and macOS=10.15.7-security_update_2021-001
Apple iOS and macOS=10.15.7-supplemental_update
Apple macOS=11.0.1
Apple macOS=11.1
Apple macOS=11.2
Oracle Communications Billing and Revenue Management=12.0.0.3.0
Oracle Communications Cloud Native Core Policy=1.14.0
Oracle Essbase=21.2
Oracle PeopleSoft Enterprise PeopleTools=8.58
All of the following
Fujitsu M10-1 Firmware<xcp2410
Fujitsu M10-1
All of the following
Fujitsu M10-4 Firmware<xcp2410
Fujitsu M10-4
All of the following
Fujitsu M10-4s Firmware<xcp2410
Fujitsu M10-4s
All of the following
Fujitsu M12-1 Firmware<xcp2410
Fujitsu M12-1
All of the following
Fujitsu M12-2 Firmware<xcp2410
Fujitsu M12-2
All of the following
Fujitsu M12-2s Firmware<xcp2410
Fujitsu M12-2s
All of the following
Fujitsu M10-1 Firmware<xcp3110
Fujitsu M10-1
All of the following
Fujitsu M10-4 Firmware<xcp3110
Fujitsu M10-4
All of the following
Fujitsu M10-4s Firmware<xcp3110
Fujitsu M10-4s
All of the following
Fujitsu M12-1 Firmware<xcp3110
Fujitsu M12-1
All of the following
Fujitsu M12-2 Firmware<xcp3110
Fujitsu M12-2
All of the following
Fujitsu M12-2s Firmware<xcp3110
Fujitsu M12-2s
Siemens Sinec Infrastructure Network Services<1.0.1.1
Splunk Universal Forwarder>=8.2.0<8.2.12
Splunk Universal Forwarder>=9.0.0<9.0.6
Splunk Universal Forwarder=9.1.0
NetApp Hci Bootstrap Os
NetApp Hci Compute Node
Fujitsu M10-1 Firmware<xcp2410
Fujitsu M10-1
Fujitsu M10-4 Firmware<xcp2410
Fujitsu M10-4
Fujitsu M10-4s Firmware<xcp2410
Fujitsu M10-4s
Fujitsu M12-1 Firmware<xcp2410
Fujitsu M12-1
Fujitsu M12-2 Firmware<xcp2410
Fujitsu M12-2
Fujitsu M12-2s Firmware<xcp2410
Fujitsu M12-2s
Fujitsu M10-1 Firmware<xcp3110
Fujitsu M10-4 Firmware<xcp3110
Fujitsu M10-4s Firmware<xcp3110
Fujitsu M12-1 Firmware<xcp3110
Fujitsu M12-2 Firmware<xcp3110
Fujitsu M12-2s Firmware<xcp3110

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.

    Fixed in 0:1-18.el8
  2. Upgrade

    Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.

    Fixed in 0:1.6.3-105.el8
  3. Upgrade

    Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.

    Fixed in 0:1.6.1-82.el8
  4. Upgrade

    Upgrade redhat/jbcs-httpd24-brotli to a version that resolves this vulnerability.

    Fixed in 0:1.0.6-40.el8
  5. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.77.0-2.el8
  6. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.37-74.el8
  7. Upgrade

    Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.

    Fixed in 0:2.11-55.el8
  8. Upgrade

    Upgrade redhat/jbcs-httpd24-nghttp2 to a version that resolves this vulnerability.

    Fixed in 0:1.39.2-37.el8
  9. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl to a version that resolves this vulnerability.

    Fixed in 1:1.1.1g-6.el8
  10. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl-chil to a version that resolves this vulnerability.

    Fixed in 0:1.0.0-5.el8
  11. Upgrade

    Upgrade redhat/jbcs-httpd24-openssl-pkcs11 to a version that resolves this vulnerability.

    Fixed in 0:0.4.10-20.el8
  12. Upgrade

    Upgrade redhat/jbcs-httpd24 to a version that resolves this vulnerability.

    Fixed in 0:1-18.jbcs.el7
  13. Upgrade

    Upgrade redhat/jbcs-httpd24-apr to a version that resolves this vulnerability.

    Fixed in 0:1.6.3-105.jbcs.el7
  14. Upgrade

    Upgrade redhat/jbcs-httpd24-apr-util to a version that resolves this vulnerability.

    Fixed in 0:1.6.1-82.jbcs.el7
  15. Upgrade

    Upgrade redhat/jbcs-httpd24-curl to a version that resolves this vulnerability.

    Fixed in 0:7.77.0-2.jbcs.el7
  16. Upgrade

    Upgrade redhat/jbcs-httpd24-httpd to a version that resolves this vulnerability.

    Fixed in 0:2.4.37-74.jbcs.el7
  17. Upgrade

    Upgrade redhat/jbcs-httpd24-jansson to a version that resolves this vulnerability.

    Fixed in 0:2.11-55.jbcs.el7
  18. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 0:7.61.1-18.el8
  19. Upgrade

    Upgrade debian/curl to a version that resolves this vulnerability.

    Fixed in 7.64.0-4+deb10u2Fixed in 7.64.0-4+deb10u7Fixed in 7.74.0-1.3+deb11u9Fixed in 7.74.0-1.3+deb11u10Fixed in 7.88.1-10+deb12u3Fixed in 7.88.1-10+deb12u4Fixed in 8.4.0-2
  20. Upgrade

    Upgrade redhat/curl to a version that resolves this vulnerability.

    Fixed in 7.74.0
  21. Upgrade

    Upgrade Apple macOS to a version that resolves this vulnerability.

    Fixed in 11.3
  22. Configuration

    Set libcurl CURLOPT_FTP_SKIP_PASV_IP to 1L, or pass --ftp-skip-pasv-ip when using the curl command line, to prevent FTP PASV responses from redirecting connections to a different IP address.

    curl/libcurl CURLOPT_FTP_SKIP_PASV_IP / --ftp-skip-pasv-ip = 1L

Event History

Dec 9, 2020
CVE Published
08:00 AM
Dec 14, 2020
CVE Published
via MITRE·07:38 PM
Data Sourced
via MITRE·07:38 PM
DescriptionWeakness
Data Sourced
via NVD·08:15 PM
RemedyDescriptionSeverityWeaknessAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

1

What is CVE-2020-8284?

CVE-2020-8284 is a vulnerability that allows a malicious server to trick curl into connecting back to a given IP address and port, potentially extracting information about private services and performing port scanning.

2

What is the severity of CVE-2020-8284?

The severity of CVE-2020-8284 is medium with a CVSS score of 3.1.

3

Which software versions are affected by CVE-2020-8284?

The Red Hat curl package version up to exclusive 7.74.0, and other related packages like jbcs-httpd24, jbcs-httpd24-apr, jbcs-httpd24-apr-util, jbcs-httpd24-brotli, jbcs-httpd24-curl, jbcs-httpd24-httpd, jbcs-httpd24-jansson, jbcs-httpd24-nghttp2, jbcs-httpd24-openssl, jbcs-httpd24-openssl-chil, jbcs-httpd24-openssl-pkcs11, curl version up to exclusive 7.61.1-18.el8, Apple Catalina, Apple Mojave, and Apple macOS Big Sur versions up to exclusive 11.3 are affected by CVE-2020-8284.

4

How can I fix CVE-2020-8284?

To fix CVE-2020-8284, update the affected software to the recommended versions: curl version 7.74.0 or later, or apply the necessary security updates provided by the software vendor.

5

Where can I find more information about CVE-2020-8284?

You can find more information about CVE-2020-8284 on the following references: [link 1](https://support.apple.com/en-us/HT212326), [link 2](https://support.apple.com/en-us/HT212327), [link 3](https://support.apple.com/en-us/HT212325).

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203