Published: 14/12/2020 Updated: 27/03/2024

CVSS v2 Base Score: 5 | Impact Score: 2.9 | Exploitability Score: 10

CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9

VMScore: 445

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

Due to use of a dangling pointer, libcurl 7.29.0 up to and including 7.71.1 can use the wrong connection when sending data.

Vulnerable Product	Search on Vulmon	Subscribe to Product
haxx libcurl
siemens sinec infrastructure network services
debian debian linux 10.0
oracle communications cloud native core policy 1.14.0
splunk universal forwarder 9.1.0
splunk universal forwarder

Debian Bug report logs - #968831 CVE-2020-8231 Package: curl; Maintainer for curl is Alessandro Ghedini <ghedo@debianorg>; Source for curl is src:curl (PTS, buildd, popcon) Reported by: Moritz Muehlenhoff <jmm@debianorg> Date: Fri, 21 Aug 2020 21:09:02 UTC Severity: important Tags: security, upstream Found in ver ...

Multiple vulnerabilities were discovered in cURL, an URL transfer library: CVE-2020-8169 Marek Szlagor reported that libcurl could be tricked into prepending a part of the password to the host name before it resolves it, potentially leaking the partial password over the network and to the DNS server(s) CVE-2020-8177 sn reporte ...

A flaw was found in libcurl from versions 7290 through 7711 An application that performs multiple requests with libcurl's multi API, and sets the `CURLOPT_CONNECT_ONLY` option, might experience libcurl using the wrong connection The highest threat from this vulnerability is to data confidentiality (CVE-2020-8231) A malicious server can use t ...

A flaw was found in libcurl from versions 7290 through 7711 An application that performs multiple requests with libcurl's multi API, and sets the `CURLOPT_CONNECT_ONLY` option, might experience libcurl using the wrong connection The highest threat from this vulnerability is to data confidentiality (CVE-2020-8231) ...

Critical Infrastructure Sectors: Energy

Critical Infrastructure Sectors: Critical Manufacturing

CWE-416 https://hackerone.com/reports/948876 https://curl.haxx.se/docs/CVE-2020-8231.html https://security.gentoo.org/glsa/202012-14 https://www.debian.org/security/2021/dsa-4881 https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf https://www.oracle.com/security-alerts/cpuapr2022.html https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=968831 https://nvd.nist.gov https://www.cisa.gov/uscert/ics/advisories/icsa-22-069-09 https://www.debian.org/security/2021/dsa-4881

CVE-2020-8231

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

References

Vulmon Search

About

Products

Connect