p PatchFirst

ALPINE-CVE-2020-8284

ALPINE-CVE-2020-8284

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

CVSS 3.7 · Low · Fix available

Published
Updated

Stack: system

Affected products and versions

  • curl Alpine:v3.11

    Affected ranges
    • ECOSYSTEM: < 7.79.0-r0

    Update to 7.79.0-r0

  • curl Alpine:v3.12

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.13

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.14

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.15

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.16

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.17

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.18

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.19

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.20

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.21

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.22

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.23

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

  • curl Alpine:v3.24

    Affected ranges
    • ECOSYSTEM: < 7.74.0-r0

    Update to 7.74.0-r0

Original sources

Check your server →