NetSight
IP …
low3.7

CVE-2020-8284

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially…

Impact

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Affected products

VendorProductAffected versions
HaxxCurl
through 7.73.0
FedoraprojectFedora
Versions 32, 33
DebianDebian Linux
Versions 9.0, 10.0
NetappClustered Data Ontap
All versions
NetappHci Management Node
All versions
NetappSolidfire
All versions
NetappHci Storage Node
All versions
NetappHci Bootstrap Os
All versions
AppleMac Os X
from 10.14.0 before 10.14.6
from 10.15 before 10.15.7
Versions 10.14.6, 10.15.7
AppleMacos
Versions 11.0.1, 11.1, 11.2
OracleCommunications Billing And Revenue Management
Version 12.0.0.3.0
OracleCommunications Cloud Native Core Policy
Version 1.14.0

Weakness classification

CWE-200

References