CVE-2020-8286

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS breakdown

Affected products

• Apple / macOS11.0 – 11.3
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.15.7 – 10.15.7
• Apple / mac_os_x10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Debian / debian_linux9.0 – 9.0
• Debian / debian_linux10.0 – 10.0
• fedoraproject / fedora33 – 33
• fedoraproject / fedora32 – 32
• haxx / libcurl7.41.0 – 7.74.0
• NetApp / Clustered Data ONTAP
• NetApp / hci_bootstrap_os
• NetApp / hci_management_node
• NetApp / hci_storage_node_firmware
• NetApp / solidfire
• oracle / communications_billing_and_revenue_management12.0.0.3.0 – 12.0.0.3.0
• oracle / communications_cloud_native_core_policy1.14.0 – 1.14.0
• oracle / essbase21.2 – 21.2
• oracle / peoplesoft_enterprise_peopletools8.58 – 8.58
• Siemens / simatic_tim_1531_irc_firmware2.2
• Siemens / sinec_infrastructure_network_services1.0.1.1
• Splunk / Universal Forwarder8.2.0 – 8.2.12
• Splunk / Universal Forwarder9.1.0 – 9.1.0

References

• MISChttps://hackerone.com/reports/1048457
• MISChttps://curl.se/docs/CVE-2020-8286.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
• MAILING_LISThttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
• MISChttps://security.gentoo.org/glsa/202012-14
• VENDOR_ADVISORYhttps://www.debian.org/security/2021/dsa-4881
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Apr/51
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Apr/50
• MAILING_LISThttp://seclists.org/fulldisclosure/2021/Apr/54
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuApr2021.html
• MISChttps://security.netapp.com/advisory/ntap-20210122-0007/
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212325
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212326
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT212327
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
• VENDOR_ADVISORYhttps://www.oracle.com//security-alerts/cpujul2021.html
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html
• MISChttps://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf