IM
IronMonkey Threat Research

CVE-2020-8286 HIGH

Published: 2020-12-14 | Last Modified: 2024-11-21 | Status: Modified

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Additional Descriptions (1)

curl versiones 7.41.0 hasta 7.73.0, es vulnerable a una comprobación inapropiada para la revocación del certificado debido a una verificación insuficiente de la respuesta OCSP

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactHIGH
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:P/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-295
[email protected] Primary
en CWE-295

Affected Products

Vendor Product Version Update Type
haxx libcurl * <built-in method update of dict object at 0x7fd3855c3580> Application
fedoraproject fedora 32 <built-in method update of dict object at 0x7fd3855c0a80> Operating System
fedoraproject fedora 33 <built-in method update of dict object at 0x7fd3423db180> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd384e817c0> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd3855c26c0> Operating System
netapp clustered_data_ontap - <built-in method update of dict object at 0x7fd3855c3880> Application
netapp hci_management_node - <built-in method update of dict object at 0x7fd3423d8c00> Application
netapp solidfire - <built-in method update of dict object at 0x7fd36a7866c0> Application
netapp hci_bootstrap_os - <built-in method update of dict object at 0x7fd3855c3c80> Operating System
netapp hci_storage_node_firmware - <built-in method update of dict object at 0x7fd3855c1c80> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd384e82600> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd3855c3500> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423dbe00> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423d8280> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd384e81940> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423d8780> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3855c08c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423db1c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd37038fec0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36b2618c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423dad80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3855c2c00> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3423d8080> Operating System
apple mac_os_x 10.15.7 <built-in method update of dict object at 0x7fd386711c40> Operating System
apple mac_os_x 10.15.7 <built-in method update of dict object at 0x7fd3106f1d80> Operating System
apple mac_os_x 10.15.7 <built-in method update of dict object at 0x7fd2983c4500> Operating System
apple mac_os_x 10.15.7 <built-in method update of dict object at 0x7fd3855c0c80> Operating System
apple macos * <built-in method update of dict object at 0x7fd2d3af6040> Operating System
siemens simatic_tim_1531_irc_firmware * <built-in method update of dict object at 0x7fd2983c5e00> Operating System
siemens sinec_infrastructure_network_services * <built-in method update of dict object at 0x7fd370363cc0> Application
oracle communications_billing_and_revenue_management 12.0.0.3.0 <built-in method update of dict object at 0x7fd36b8fdf00> Application
oracle communications_cloud_native_core_policy 1.14.0 <built-in method update of dict object at 0x7fd3081a6180> Application
oracle essbase 21.2 <built-in method update of dict object at 0x7fd2983c6c40> Application
oracle peoplesoft_enterprise_peopletools 8.58 <built-in method update of dict object at 0x7fd3703cc280> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2983c5b40> Application
splunk universal_forwarder * <built-in method update of dict object at 0x7fd2983c7700> Application
splunk universal_forwarder 9.1.0 <built-in method update of dict object at 0x7fd2983c50c0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:haxx:libcurl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:hci_bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.15.7:-:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.15.7:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.15.7:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:siemens:simatic_tim_1531_irc_firmware:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:siemens:simatic_tim_1531_irc:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:essbase:21.2:*:*:*:*:*:*:*
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:splunk:universal_forwarder:9.1.0:*:*:*:*:*:*:*

References