What’s Vulnerable › Vulnerabilities
CVE-2020-8284
- Severity: low (CVSS 3.7 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 3.9% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-12-14 · updated 2026-10-14
- Weakness: CWE-200
Description
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Affected products
- macOS: from 10.14.0 before 10.14.6; from 10.15 before 10.15.7; 10.14.6-security_update_2019-001, 10.14.6-security_update_2019-002, 10.14.6-security_update_2019-004, 10.14.6-security_update_2019-005, 10.14.6-security_update_2019-006, 10.14.6-security_update_2019-007 (+18) — fixed in 10.14.6, 10.15.7
- Apple macOS: 11.0.1, 11.1, 11.2
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 32, 33
- Fujitsu M10-1 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M10-4 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M10-4S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-1 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-2 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-2S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- curl: through 7.73.0
- Clustered Data ONTAP: all versions
- NetApp Hci Bootstrap Os: all versions
- NetApp Hci Management Node: all versions
- NetApp Hci Storage Node: all versions
- NetApp Solidfire: all versions
- Oracle Corporation Communications Billing and Revenue Management: 12.0.0.3.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Corporation Oracle Essbase: 21.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: macOS 10.14.6, 10.15.7; Fujitsu M10-1 Firmware xcp2410, xcp3110; Fujitsu M10-4 Firmware xcp2410, xcp3110; Fujitsu M10-4S Firmware xcp2410, xcp3110; Fujitsu M12-1 Firmware xcp2410, xcp3110; Fujitsu M12-2 Firmware xcp2410, xcp3110; Fujitsu M12-2S Firmware xcp2410, xcp3110; Siemens Sinec Infrastructure Network Services 1.0.1.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://curl.se/docs/CVE-2020-8284.html
- https://hackerone.com/reports/1040166
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- https://security.gentoo.org/glsa/202012-14
- https://security.netapp.com/advisory/ntap-20210122-0007/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- https://www.debian.org/security/2021/dsa-4881
Get alerted when CVE-2020-8284 or the next vulnerability affects your stack