What’s Vulnerable › Vulnerabilities
CVE-2020-8285
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 9.8% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-12-14 · updated 2026-10-14
- Weakness: CWE-674
Description
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Affected products
- macOS: before 10.14.6; from 10.15 before 10.15.7; 10.14.6, 10.14.6-security_update_2019-001, 10.14.6-security_update_2019-002, 10.14.6-security_update_2020-001, 10.14.6-security_update_2020-002, 10.14.6-security_update_2020-003 (+9) — fixed in 10.14.6, 10.15.7
- Apple macOS: from 11.0 before 11.3 — fixed in 11.3
- Debian Linux: 9.0, 10.0
- Fedoraproject Fedora: 32, 33
- Fujitsu M10-1 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M10-4 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M10-4S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-1 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-2 Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- Fujitsu M12-2S Firmware: before xcp2410; before xcp3110 — fixed in xcp2410, xcp3110
- curl: from 7.21.0 before 7.74.0 — fixed in 7.74.0
- Clustered Data ONTAP: all versions
- NetApp Hci Bootstrap Os: all versions
- NetApp Hci Management Node: all versions
- NetApp Hci Storage Node Firmware: all versions
- NetApp Solidfire: all versions
- Oracle Corporation Communications Billing and Revenue Management: 12.0.0.3.0
- Oracle Communications Cloud Native Core Policy: 1.14.0
- Oracle Corporation Oracle Essbase: 21.2
- Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
- Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
- Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6
How to fix
Upgrade to a fixed version: macOS 10.14.6, 10.15.7; Apple macOS 11.3; Fujitsu M10-1 Firmware xcp2410, xcp3110; Fujitsu M10-4 Firmware xcp2410, xcp3110; Fujitsu M10-4S Firmware xcp2410, xcp3110; Fujitsu M12-1 Firmware xcp2410, xcp3110; Fujitsu M12-2 Firmware xcp2410, xcp3110; Fujitsu M12-2S Firmware xcp2410, xcp3110; curl 7.74.0; Siemens Sinec Infrastructure Network Services 1.0.1.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.
References
- http://seclists.org/fulldisclosure/2021/Apr/51
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://curl.se/docs/CVE-2020-8285.html
- https://github.com/curl/curl/issues/6255
- https://hackerone.com/reports/1045844
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- https://security.gentoo.org/glsa/202012-14
- https://security.netapp.com/advisory/ntap-20210122-0007/
Get alerted when CVE-2020-8285 or the next vulnerability affects your stack