CVE-2020-8286

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Scores

Faiblesses (CWE)

• CWE-295

Références européennes

• ENISA EUVD · EUVD-2020-29154
• GCVE · GCVE-0-2020-8286

Avis du CERT-FR

• CERTFR-2024-AVI-0297 — Multiples vulnérabilités dans Juniper · cert.ssi.gouv.fr
• CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
• CERTFR-2023-AVI-0701 — Multiples vulnérabilités dans Splunk · cert.ssi.gouv.fr
• CERTFR-2023-AVI-0428 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
• CERTFR-2022-AVI-216 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
• CERTFR-2021-AVI-791 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2021-AVI-555 — Multiples vulnérabilités dans Juniper Junos OS · cert.ssi.gouv.fr
• CERTFR-2021-AVI-442 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
• CERTFR-2021-AVI-314 — Multiples vulnérabilités dans les produits Apple · cert.ssi.gouv.fr

Configurations affectées (CPE NVD)

• cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:* ≥ 7.41.0 < 7.74.0
• cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
• cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
• cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
• cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*
• cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* < 10.14.6
• cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:* ≥ 10.15 < 10.15.7
• cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
• cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*
• cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* ≥ 11.0 < 11.3
• cpe:2.3:o:siemens:simatic_tim_1531_irc_firmware:*:*:*:*:*:*:*:* ≤ 2.2
• cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:* < 1.0.1.1
• cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*
• cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* ≥ 8.2.0 < 8.2.12
• cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:* ≥ 9.0.0 < 9.0.6
• cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

Produits affectés

Références

• https://hackerone.com/reports/1048457
• https://curl.se/docs/CVE-2020-8286.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• https://security.gentoo.org/glsa/202012-14
• https://www.debian.org/security/2021/dsa-4881
• http://seclists.org/fulldisclosure/2021/Apr/51
• http://seclists.org/fulldisclosure/2021/Apr/50
• http://seclists.org/fulldisclosure/2021/Apr/54
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://security.netapp.com/advisory/ntap-20210122-0007/
• https://support.apple.com/kb/HT212325
• https://support.apple.com/kb/HT212326
• https://support.apple.com/kb/HT212327
• https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
• https://cert-portal.siemens.com/productcert/html/ssa-200951.html
• https://cert-portal.siemens.com/productcert/html/ssa-389290.html
• https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Sources