CVEvulnerability
CVE-2020-8286
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2020-12-14
- Last modified
- 2026-10-14
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-295
Description
curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.
Affected configurations
• haxx libcurl (>= 7.41.0 < 7.74.0)
• fedoraproject fedora 32
• fedoraproject fedora 33
• debian debian linux 9.0
• debian debian linux 10.0
• netapp clustered data ontap
• netapp hci management node
• netapp solidfire
• netapp hci bootstrap os
• netapp hci storage node firmware
• apple mac os x (< 10.14.6)
• apple mac os x (>= 10.15 < 10.15.7)
• apple mac os x 10.14.6
• apple mac os x 10.15.7
• apple macos (>= 11.0 < 11.3)
• siemens simatic tim 1531 irc firmware (<= 2.2)
• siemens sinec infrastructure network services (< 1.0.1.1)
• oracle communications billing and revenue management 12.0.0.3.0
• oracle communications cloud native core policy 1.14.0
• oracle essbase 21.2
• oracle peoplesoft enterprise peopletools 8.58
• splunk universal forwarder (>= 8.2.0 < 8.2.12)
• splunk universal forwarder (>= 9.0.0 < 9.0.6)
• splunk universal forwarder 9.1.0
Related
Weakness · CWE (1)
- CWE-295 Improper Certificate Validation weakness
References
- http://seclists.org/fulldisclosure/2021/Apr/50 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Apr/51 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Apr/54 Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://curl.se/docs/CVE-2020-8286.html Vendor Advisory
- https://hackerone.com/reports/1048457 Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202012-14 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0007/ Third Party Advisory
- https://support.apple.com/kb/HT212325 Third Party Advisory
- https://support.apple.com/kb/HT212326 Third Party Advisory
- https://support.apple.com/kb/HT212327 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4881 Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Apr/50 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Apr/51 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/Apr/54 Mailing List, Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf Third Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
- https://curl.se/docs/CVE-2020-8286.html Vendor Advisory
- https://hackerone.com/reports/1048457 Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ Mailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202012-14 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210122-0007/ Third Party Advisory
- https://support.apple.com/kb/HT212325 Third Party Advisory
- https://support.apple.com/kb/HT212326 Third Party Advisory
- https://support.apple.com/kb/HT212327 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4881 Third Party Advisory
- https://www.oracle.com//security-alerts/cpujul2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuApr2021.html Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-200951.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-389290.html cert-portal.siemens.com
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html cert-portal.siemens.com