Read the docs
Red Hat Security Advisory

RHSA-2021:1610

curl security and bug fix update

Released 2021-05-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2020-06702 CVE-2020-8285 · GHSA-4p2h-jggv-23jg

Uncontrolled recursion in https://github.com/curl/curl

Priority HIGH 72

curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0977 Published 2020-12-14 Partial fix CWE-674
TI-2020-06701 CVE-2020-8284 · GHSA-69rc-qfx4-h683

Information disclosure in https://github.com/curl/curl

Priority MEDIUM 51

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherw…

CVSS 3.1LOW 3.7 Network No auth No interaction EPSS 0.03898 Published 2020-12-14 Partial fix CWE-200
TI-2020-06703 CVE-2020-8286 · GHSA-xh5x-q49r-r9w4

Improper certificate validation in https://github.com/curl/curl

Priority MEDIUM 46

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04631 Published 2020-12-14 Partial fix CWE-295