CVE and update status of the FreeBSD ports tree4,526 unaddressed CVEs in 616 portsAll times are CET

CVE details

CVE-2020-8284

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Score
3.7 low
Published
2020-12-14
Links
NVD · cve.org

Affected ports (1)

PortPackageVersionStatusMaintainer
ftp/linux-c7-curllinux-c7-curl7.29.0_13unaddressedemulation@FreeBSD.org

VuXML

Template for a VuXML entry

Range taken from the CVE record, check it before committing. make newentry in security/vuxml creates the vid.

  <vuln vid="FIXME (make newentry)">
    <topic>FIXME -- FIXME</topic>
    <affects>
      <package>
	<name>linux-c7-curl</name>
	<range><lt>FIXME</lt></range>
      </package>
    </affects>
    <description>
      <body xmlns="http://www.w3.org/1999/xhtml">
	<p>A malicious server can use the FTP PASV response to trick curl 7.73.0
	and earlier into connecting back to a given IP address and port, and
	this way potentially make curl extract information about services that
	are otherwise private and not disclosed, for example doing port
	scanning and service banner extractions.</p>
      </body>
    </description>
    <references>
      <cvename>CVE-2020-8284</cvename>
      <url>https://nvd.nist.gov/vuln/detail/CVE-2020-8284</url>
    </references>
    <dates>
      <discovery>2020-12-14</discovery>
      <entry>2026-10-25</entry>
    </dates>
  </vuln>