CVE-2020-8286

HIGH | Platform: macOS | Changelog

CVE Details

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

CVSS 3.1 Score

Metric	Value
Base Score	7.5 (HIGH)
Vector	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N`

Weakness

CWE-295

References

Apple Security Advisory
NVD Entry
http://seclists.org/fulldisclosure/2021/Apr/50 (Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Apr/51 (Mailing List, Third Party Advisory)
http://seclists.org/fulldisclosure/2021/Apr/54 (Mailing List, Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf (Third Party Advisory)
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf (Patch, Third Party Advisory)
https://curl.se/docs/CVE-2020-8286.html (Vendor Advisory)
https://hackerone.com/reports/1048457 (Exploit, Patch, Third Party Advisory)
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html (Mailing List, Third Party Advisory)