CVE-2020-8286
CVE-2020-8286
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
CVSS 7.5 · Alta · EPSS 4,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
https://github.com/curl/curl
- Versiones
- 7.41.0 to and including 7.73.0: Afectada
Sin corrección publicada
curl Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.74.0-1
Actualiza a 7.74.0-1
curl Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.74.0-1
Actualiza a 7.74.0-1
curl Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.74.0-1
Actualiza a 7.74.0-1
curl Ubuntu:16.04:LTS
- Versiones
- 7.43.0-1ubuntu2
- 7.45.0-1ubuntu1
- 7.46.0-1ubuntu1
- 7.47.0-1ubuntu1
- 7.47.0-1ubuntu2
- 7.47.0-1ubuntu2.1
- 7.47.0-1ubuntu2.2
- 7.47.0-1ubuntu2.3
- 7.47.0-1ubuntu2.4
- 7.47.0-1ubuntu2.5
- 7.47.0-1ubuntu2.6
- 7.47.0-1ubuntu2.7
- 7.47.0-1ubuntu2.8
- 7.47.0-1ubuntu2.9
- 7.47.0-1ubuntu2.11
- 7.47.0-1ubuntu2.12
- 7.47.0-1ubuntu2.13
- 7.47.0-1ubuntu2.14
- 7.47.0-1ubuntu2.15
- 7.47.0-1ubuntu2.16
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.47.0-1ubuntu2.18
Actualiza a 7.47.0-1ubuntu2.18
curl Ubuntu:18.04:LTS
- Versiones
- 7.55.1-1ubuntu2
- 7.55.1-1ubuntu2.1
- 7.57.0-1ubuntu1
- 7.58.0-2ubuntu1
- 7.58.0-2ubuntu2
- 7.58.0-2ubuntu3
- 7.58.0-2ubuntu3.1
- 7.58.0-2ubuntu3.2
- 7.58.0-2ubuntu3.3
- 7.58.0-2ubuntu3.5
- 7.58.0-2ubuntu3.6
- 7.58.0-2ubuntu3.7
- 7.58.0-2ubuntu3.8
- 7.58.0-2ubuntu3.9
- 7.58.0-2ubuntu3.10
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.58.0-2ubuntu3.12
Actualiza a 7.58.0-2ubuntu3.12
curl Ubuntu:20.04:LTS
- Versiones
- 7.65.3-1ubuntu3
- 7.65.3-1ubuntu4
- 7.66.0-1ubuntu1
- 7.67.0-2ubuntu1
- 7.68.0-1ubuntu1
- 7.68.0-1ubuntu2
- 7.68.0-1ubuntu2.1
- 7.68.0-1ubuntu2.2
- Intervalos de versiones afectados
- ECOSYSTEM: < 7.68.0-1ubuntu2.4
Actualiza a 7.68.0-1ubuntu2.4
Fuentes originales
- https://hackerone.com/reports/1048457
- https://curl.se/docs/CVE-2020-8286.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/
- https://security.gentoo.org/glsa/202012-14
- https://www.debian.org/security/2021/dsa-4881
- http://seclists.org/fulldisclosure/2021/Apr/51
- http://seclists.org/fulldisclosure/2021/Apr/50
- http://seclists.org/fulldisclosure/2021/Apr/54
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://security.netapp.com/advisory/ntap-20210122-0007/
- https://support.apple.com/kb/HT212325
- https://support.apple.com/kb/HT212326
- https://support.apple.com/kb/HT212327
- https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf
- https://cert-portal.siemens.com/productcert/html/ssa-200951.html
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
- https://nvd.nist.gov/vuln/detail/CVE-2020-8286