SNOW-564702: curlcurl-7_68_0: 3 vulnerabilities (highest severity is: 7.5) - autoclosed
Closed this issue · 1 comments
Vulnerable Library - curlcurl-7_68_0
A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features
Library home page: https://github.com/bagder/curl.git
Vulnerable Source Files (4)
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/multi.c
/deps/curl-7.68.0/lib/easy.c
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2020-8231 | 7.5 | curlcurl-7_68_0 | Direct | curl-7_72_0 | ❌ | |
CVE-2020-8285 | 7.5 | curlcurl-7_68_0 | Direct | 7.74.0 | ❌ | |
CVE-2020-8284 | 3.7 | curlcurl-7_68_0 | Direct | 7.74.0 | ❌ |
Details
CVE-2020-8231
Vulnerable Library - curlcurl-7_68_0
A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features
Library home page: https://github.com/bagder/curl.git
Found in base branch: master
Vulnerable Source Files (4)
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/connect.c
/deps/curl-7.68.0/lib/multi.c
/deps/curl-7.68.0/lib/easy.c
Vulnerability Details
Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.
Publish Date: 2020-12-14
URL: CVE-2020-8231
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://github.com/curl/curl/tree/curl-7_72_0
Release Date: 2020-12-14
Fix Resolution: curl-7_72_0
CVE-2020-8285
Vulnerable Library - curlcurl-7_68_0
A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features
Library home page: https://github.com/bagder/curl.git
Found in base branch: master
Vulnerable Source Files (2)
/deps/curl-7.68.0/lib/ftp.c
/deps/curl-7.68.0/lib/ftp.c
Vulnerability Details
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Publish Date: 2020-12-14
URL: CVE-2020-8285
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://curl.se/docs/CVE-2020-8285.html
Release Date: 2020-12-14
Fix Resolution: 7.74.0
CVE-2020-8284
Vulnerable Library - curlcurl-7_68_0
A command line tool and library for transferring data with URL syntax, supporting HTTP, HTTPS, FTP, FTPS, GOPHER, TFTP, SCP, SFTP, SMB, TELNET, DICT, LDAP, LDAPS, FILE, IMAP, SMTP, POP3, RTSP and RTMP. libcurl offers a myriad of powerful features
Library home page: https://github.com/bagder/curl.git
Found in base branch: master
Vulnerable Source Files (2)
/deps/curl-7.68.0/src/tool_cfgable.c
/deps/curl-7.68.0/src/tool_cfgable.c
Vulnerability Details
A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.
Publish Date: 2020-12-14
URL: CVE-2020-8284
CVSS 3 Score Details (3.7)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://curl.se/docs/CVE-2020-8284.html
Release Date: 2020-12-14
Fix Resolution: 7.74.0
✔️ This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.