CVE-2020-8285

Description

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVSS breakdown

Affected products

• Apple / macOS11.0 – 11.3
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Debian / debian_linux9.0 – 9.0
• Debian / debian_linux10.0 – 10.0
• fedoraproject / fedora32 – 32
• fedoraproject / fedora33 – 33
• Fujitsu / m10-1_firmwarexcp2410
• Fujitsu / m10-4_firmwarexcp2410
• Fujitsu / m10-4s_firmwarexcp2410
• Fujitsu / m12-1_firmwarexcp2410
• Fujitsu / m12-2_firmwarexcp2410
• Fujitsu / m12-2s_firmwarexcp2410
• haxx / libcurl7.21.0 – 7.74.0
• NetApp / Clustered Data ONTAP
• NetApp / hci_bootstrap_os
• NetApp / hci_management_node
• NetApp / hci_storage_node_firmware
• NetApp / solidfire
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_cloud_native_core_policy1.14.0 – 1.14.0
• oracle / essbase21.2 – 21.2
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• Siemens / sinec_infrastructure_network_services1.0.1.1
• Splunk / Universal Forwarder8.2.0 – 8.2.12
• Splunk / Universal Forwarder9.1.0 – 9.1.0

References

• MISChttps://hackerone.com/reports/1045844
• MISChttps://github.com/curl/curl/issues/6255
• MISChttps://curl.se/docs/CVE-2020-8285.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• MISChttps://security.gentoo.org/glsa/202012-14
• VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-4881
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Apr/51
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• MISChttps://security.netapp.com/advisory/ntap-20210122-0007/
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212325
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212326
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212327
• MAILING_LISThttps://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
• MAILING_LISThttps://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpujan2022.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf