CVE-2020-8286 - 漏洞详情

CVE-2020-8286 (CNNVD-202012-755)

HIGH

中文标题:

HAXX libcurl 信任管理问题漏洞

英文标题:

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insu...

CVSS分数: 7.5

发布时间: 2020-12-14 19:39:28

漏洞类型: 信任管理问题

状态: PUBLISHED

数据质量分数: 0.30

数据版本: v3

漏洞描述

中文描述:

HAXX Haxx libcurl是瑞典HAXX公司的一个免费、开源的客户端URL传输库。该库支持FTP、FTPS、TFTP、HTTP等。 HAXX libcurl 存在信任管理问题漏洞，攻击者可利用该漏洞通过在libcurl上进行低级OCSP验证，充当中间人，在会话中读取或写入数据。

英文描述:

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CWE类型:

CWE-295

受影响产品

厂商	产品	版本	版本范围	平台	CPE
haxx	libcurl	*	-	-	`cpe:2.3:a:haxx:libcurl::::::::`
fedoraproject	fedora	32	-	-	`cpe:2.3:o:fedoraproject:fedora:32:::::::*`
fedoraproject	fedora	33	-	-	`cpe:2.3:o:fedoraproject:fedora:33:::::::*`
debian	debian_linux	9.0	-	-	`cpe:2.3:o:debian:debian_linux:9.0:::::::*`
debian	debian_linux	10.0	-	-	`cpe:2.3:o:debian:debian_linux:10.0:::::::*`
netapp	clustered_data_ontap	-	-	-	`cpe:2.3:a:netapp:clustered_data_ontap:-:::::::*`
netapp	hci_management_node	-	-	-	`cpe:2.3:a:netapp:hci_management_node:-:::::::*`
netapp	solidfire	-	-	-	`cpe:2.3:a:netapp:solidfire:-:::::::*`
netapp	hci_bootstrap_os	-	-	-	`cpe:2.3:o:netapp:hci_bootstrap_os:-:::::::*`
netapp	hci_storage_node_firmware	-	-	-	`cpe:2.3:o:netapp:hci_storage_node_firmware:-:::::::*`
apple	mac_os_x	*	-	-	`cpe:2.3:o:apple:mac_os_x::::::::`
apple	mac_os_x	10.14.6	-	-	`cpe:2.3:o:apple:mac_os_x:10.14.6:-::::::`
apple	mac_os_x	10.15.7	-	-	`cpe:2.3:o:apple:mac_os_x:10.15.7:-::::::`
apple	macos	*	-	-	`cpe:2.3:o:apple:macos::::::::`
siemens	simatic_tim_1531_irc_firmware	*	-	-	`cpe:2.3:o:siemens:simatic_tim_1531_irc_firmware::::::::`
siemens	sinec_infrastructure_network_services	*	-	-	`cpe:2.3:a:siemens:sinec_infrastructure_network_services::::::::`
oracle	communications_billing_and_revenue_management	12.0.0.3.0	-	-	`cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:::::::*`
oracle	communications_cloud_native_core_policy	1.14.0	-	-	`cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:::::::*`
oracle	essbase	21.2	-	-	`cpe:2.3:a:oracle:essbase:21.2:::::::*`
oracle	peoplesoft_enterprise_peopletools	8.58	-	-	`cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:::::::*`
splunk	universal_forwarder	*	-	-	`cpe:2.3:a:splunk:universal_forwarder::::::::`
splunk	universal_forwarder	9.1.0	-	-	`cpe:2.3:a:splunk:universal_forwarder:9.1.0:::::::*`

解决方案

中文解决方案:

（暂无数据）

英文解决方案:

（暂无数据）

临时解决方案:

（暂无数据）

参考链接

无标题 x_refsource_MISC
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问

FEDORA-2020-ceaf490686 vendor-advisory
cve.org

访问

[debian-lts-announce] 20201219 [SECURITY] [DLA 2500-1] curl security update mailing-list
cve.org

访问

FEDORA-2020-7ab62c73bc vendor-advisory
cve.org

访问

GLSA-202012-14 vendor-advisory
cve.org

访问

DSA-4881 vendor-advisory
cve.org

访问

20210427 APPLE-SA-2021-04-26-3 Security Update 2021-002 Catalina mailing-list
cve.org

访问

20210427 APPLE-SA-2021-04-26-2 macOS Big Sur 11.3 mailing-list
cve.org

访问

20210427 APPLE-SA-2021-04-26-4 Security Update 2021-003 Mojave mailing-list
cve.org

访问

无标题 x_refsource_MISC
cve.org

访问