CVE catalog

CVE-2020-8284

curl: CVE-2020-8284

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
3.90% · Oct 25, 2026

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiancurlsid8.23.0-1fixed
Debiancurlforky8.22.0-1fixed
Debiancurltrixie8.14.1-2+deb13u5fixed
Debiancurltrixie-security8.14.1-2+deb13u7fixed
Debiancurlbookworm7.88.1-10+deb12u15fixed
Debiancurlbookworm-security7.88.1-10+deb12u5fixed
CpecurlNot reportedNot reportedunknown
CpefedoraNot reportedNot reportedunknown
Cpedebian_linuxNot reportedNot reportedunknown
Cpeclustered_data_ontapNot reportedNot reportedunknown
Cpehci_management_nodeNot reportedNot reportedunknown
CpesolidfireNot reportedNot reportedunknown
Cpehci_storage_nodeNot reportedNot reportedunknown
Cpehci_bootstrap_osNot reportedNot reportedunknown
Cpemac_os_xNot reportedNot reportedunknown
Alpinecurl3.117.79.0-r0fixed
Alpinecurl3.127.74.0-r0fixed
Alpinecurl3.137.74.0-r0fixed
Alpinecurl3.147.74.0-r0fixed
Alpinecurl3.157.74.0-r0fixed
Alpinecurl3.167.74.0-r0fixed
Alpinecurl3.177.74.0-r0fixed
Alpinecurl3.187.74.0-r0fixed
Alpinecurl3.197.74.0-r0fixed
Alpinecurl3.207.74.0-r0fixed
Alpinecurl3.217.74.0-r0fixed
Alpinecurl3.227.74.0-r0fixed
Alpinecurl3.237.74.0-r0fixed
Alpinecurl3.247.74.0-r0fixed
Ubuntucurlpro7.32.0-1ubuntu1vulnerable
Ubuntucurlpro7.33.0-1ubuntu1vulnerable
Ubuntucurlpro7.34.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.6vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.7vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.8vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.9vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.10vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.11vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.12vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.13vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.14vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.15vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.16vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.17vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.19vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm4vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm6fixed
Ubuntucurlpro7.32.0-1ubuntu1vulnerable
Ubuntucurlpro7.33.0-1ubuntu1vulnerable
Ubuntucurlpro7.34.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.1vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.6vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.7vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.8vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.9vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.10vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.11vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.12vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.13vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.14vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.15vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.16vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.17vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.19vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm2vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm3vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm4vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm5vulnerable
Ubuntucurlpro7.35.0-1ubuntu2.20+esm6fixed
Ubuntucurl16.047.43.0-1ubuntu2vulnerable
Ubuntucurl16.047.45.0-1ubuntu1vulnerable
Ubuntucurl16.047.46.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.1vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.2vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.3vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.4vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.5vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.6vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.7vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.8vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.9vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.11vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.12vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.13vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.14vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.15vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.16vulnerable
Ubuntucurl16.047.47.0-1ubuntu2.18fixed
Ubuntucurl18.047.55.1-1ubuntu2vulnerable
Ubuntucurl18.047.55.1-1ubuntu2.1vulnerable
Ubuntucurl18.047.57.0-1ubuntu1vulnerable
Ubuntucurl18.047.58.0-2ubuntu1vulnerable
Ubuntucurl18.047.58.0-2ubuntu2vulnerable
Ubuntucurl18.047.58.0-2ubuntu3vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.1vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.2vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.3vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.5vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.6vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.7vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.8vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.9vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.10vulnerable
Ubuntucurl18.047.58.0-2ubuntu3.12fixed
Ubuntucurl20.047.65.3-1ubuntu3vulnerable
Ubuntucurl20.047.65.3-1ubuntu4vulnerable
Ubuntucurl20.047.66.0-1ubuntu1vulnerable
Ubuntucurl20.047.67.0-2ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.1vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.2vulnerable
Ubuntucurl20.047.68.0-1ubuntu2.4fixed
Susecurllinux enterprise software development kit 12 sp57.60.0-11.9.1fixed
Susecurllinux enterprise server 12 sp57.60.0-11.9.1fixed
Susecurllinux enterprise server for sap applications 12 sp57.60.0-11.9.1fixed
Opensusecurlleap 15.27.66.0-lp152.3.12.1fixed
Opensusecurl-minileap 15.27.66.0-lp152.3.12.1fixed
Opensusecurlleap 15.17.60.0-lp151.5.18.1fixed
Opensusecurl-minileap 15.17.60.0-lp151.5.18.1fixed
Susecurllinux enterprise module for basesystem 15 sp27.66.0-4.11.1fixed
Susecurllinux enterprise module for basesystem 15 sp17.60.0-3.35.1fixed
Susecurl-openssl1linux enterprise server 11-security7.37.0-70.57.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiancurlsourcesid7.74.0-1not yet assignedNot reported[977163]
Debiancurlsourceforky7.74.0-1not yet assignedNot reported[977163]
Debiancurlsourcetrixie7.74.0-1not yet assignedNot reported[977163]
Debiancurlsourcebookworm7.74.0-1not yet assignedNot reported[977163]
Alpinecurlapk3.117.79.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.127.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.137.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.147.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.157.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.167.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.177.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.187.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.197.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.207.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.217.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.227.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.237.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Alpinecurlapk3.247.74.0-r0Not reportedALPINE-CVE-2020-8284Not reported
Ubuntucurldebpro7.35.0-1ubuntu2.20+esm6Not reportedUSN-4665-2Not reported
Ubuntucurldebpro7.35.0-1ubuntu2.20+esm6Not reportedUBUNTU-CVE-2020-8284Not reported
Ubuntucurldeb16.047.47.0-1ubuntu2.18Not reportedUBUNTU-CVE-2020-8284Not reported
Ubuntucurldeb18.047.58.0-2ubuntu3.12Not reportedUBUNTU-CVE-2020-8284Not reported
Ubuntucurldeb20.047.68.0-1ubuntu2.4Not reportedUBUNTU-CVE-2020-8284Not reported
Susecurlrpmlinux enterprise software development kit 12 sp57.60.0-11.9.1Not reportedSUSE-SU-2020:3739-1Not reported
Susecurlrpmlinux enterprise server 12 sp57.60.0-11.9.1Not reportedSUSE-SU-2020:3739-1Not reported
Susecurlrpmlinux enterprise server for sap applications 12 sp57.60.0-11.9.1Not reportedSUSE-SU-2020:3739-1Not reported
Opensusecurlrpmleap 15.27.66.0-lp152.3.12.1Not reportedOPENSUSE-SU-2020:2238-1Not reported
Opensusecurl-minirpmleap 15.27.66.0-lp152.3.12.1Not reportedOPENSUSE-SU-2020:2238-1Not reported
Opensusecurlrpmleap 15.17.60.0-lp151.5.18.1Not reportedOPENSUSE-SU-2020:2249-1Not reported
Opensusecurl-minirpmleap 15.17.60.0-lp151.5.18.1Not reportedOPENSUSE-SU-2020:2249-1Not reported
Susecurlrpmlinux enterprise module for basesystem 15 sp27.66.0-4.11.1Not reportedSUSE-SU-2020:3735-1Not reported
Susecurlrpmlinux enterprise module for basesystem 15 sp17.60.0-3.35.1Not reportedSUSE-SU-2020:3733-1Not reported
Susecurl-openssl1rpmlinux enterprise server 11-security7.37.0-70.57.1Not reportedSUSE-SU-2020:14585-1Not reported

[Debian bug #977163]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [curl]Unknown
    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • [libcurl3-nss]Unknown

    Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • [libcurl4]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • [libcurl4-doc]Unknown

    Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · all · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · all · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · all · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (4)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

  • Source package: [curl]

    Details (6)
    • 7.88.1-10+deb12u15 · amd64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u15 · arm64 · bookworm

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · amd64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 8.14.1-2+deb13u2~bpo13+1 · arm64 · bookworm-backports

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · amd64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

    • 7.88.1-10+deb12u5 · arm64 · bookworm-security

      Fixed · Fixed: 7.74.0-1

      dsa · curl · debian · bookworm

Observed:

References