CVE-2020-8284

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

• haxx curl (<= 7.73.0) • fedoraproject fedora 32 • fedoraproject fedora 33 • debian debian linux 9.0 • debian debian linux 10.0 • netapp clustered data ontap • netapp hci management node • netapp solidfire • netapp hci storage node • netapp hci bootstrap os • apple mac os x (>= 10.14.0 < 10.14.6) • apple mac os x (>= 10.15 < 10.15.7) • apple mac os x 10.14.6 • apple mac os x 10.15.7 • apple macos 11.0.1 • apple macos 11.1 • apple macos 11.2 • oracle communications billing and revenue management 12.0.0.3.0 • oracle communications cloud native core policy 1.14.0 • oracle essbase 21.2 • oracle peoplesoft enterprise peopletools 8.58 • fujitsu m10-1 firmware (< xcp2410) • fujitsu m10-4 firmware (< xcp2410) • fujitsu m10-4s firmware (< xcp2410) • fujitsu m12-1 firmware (< xcp2410) • fujitsu m12-2 firmware (< xcp2410) • fujitsu m12-2s firmware (< xcp2410) • fujitsu m10-1 firmware (< xcp3110) • fujitsu m10-4 firmware (< xcp3110) • fujitsu m10-4s firmware (< xcp3110) • fujitsu m12-1 firmware (< xcp3110) • fujitsu m12-2 firmware (< xcp3110) • fujitsu m12-2s firmware (< xcp3110) • siemens sinec infrastructure network services (< 1.0.1.1) • splunk universal forwarder (>= 8.2.0 < 8.2.12) • splunk universal forwarder (>= 9.0.0 < 9.0.6) • splunk universal forwarder 9.1.0