What’s Vulnerable › Vulnerabilities

CVE-2020-8286

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-12-14 · updated 2026-10-14
• Weakness: CWE-295

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Affected products

• macOS: before 10.14.6; from 10.15 before 10.15.7; 10.14.6, 10.14.6-security_update_2019-001, 10.14.6-security_update_2019-002, 10.14.6-security_update_2020-001, 10.14.6-security_update_2020-002, 10.14.6-security_update_2020-003 (+9) — fixed in 10.14.6, 10.15.7
• Apple macOS: from 11.0 before 11.3 — fixed in 11.3
• Debian Linux: 9.0, 10.0
• Fedoraproject Fedora: 32, 33
• curl: from 7.41.0 before 7.74.0 — fixed in 7.74.0
• Clustered Data ONTAP: all versions
• NetApp Hci Bootstrap Os: all versions
• NetApp Hci Management Node: all versions
• NetApp Hci Storage Node Firmware: all versions
• NetApp Solidfire: all versions
• Oracle Corporation Communications Billing and Revenue Management: 12.0.0.3.0
• Oracle Communications Cloud Native Core Policy: 1.14.0
• Oracle Corporation Oracle Essbase: 21.2
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.58
• Siemens Simatic Tim 1531 Irc Firmware: through 2.2
• Siemens Sinec Infrastructure Network Services: before 1.0.1.1 — fixed in 1.0.1.1
• Splunk Universal Forwarder: from 8.2.0 before 8.2.12; from 9.0.0 before 9.0.6; 9.1.0 — fixed in 8.2.12, 9.0.6

How to fix

Upgrade to a fixed version: macOS 10.14.6, 10.15.7; Apple macOS 11.3; curl 7.74.0; Siemens Sinec Infrastructure Network Services 1.0.1.1; Splunk Universal Forwarder 8.2.12, 9.0.6. Check the vendor advisory for mitigations.

References

• http://seclists.org/fulldisclosure/2021/Apr/50
• http://seclists.org/fulldisclosure/2021/Apr/51
• http://seclists.org/fulldisclosure/2021/Apr/54
• https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://curl.se/docs/CVE-2020-8286.html
• https://hackerone.com/reports/1048457
• https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• https://security.gentoo.org/glsa/202012-14
• https://security.netapp.com/advisory/ntap-20210122-0007/

Get alerted when CVE-2020-8286 or the next vulnerability affects your stack