CVE-2020-8285 Denial of service in https://github.com/curl/curl
An attacker can cause a stack overflow and crash the application via malicious FTP wildcard patterns in the curl library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8285?
CVE-2020-8285 is a high-severity denial of service vulnerability in Apple Mac Os X, published on 14 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
Which versions are affected by CVE-2020-8285?
It affects 22 products.
Products include Apple Mac Os X, Apple Macos, Debian Debian Linux, Fedoraproject Fedora, Fujitsu M10-1 Firmware, Fujitsu M10-4 Firmware and 16 more.
How do I fix CVE-2020-8285?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2020-8285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-8285 exists.
Other vulnerabilities in Apple Mac Os X
Sources
Also known as ALPINE-CVE-2020-8285, CLEANSTART-2026-AM91328, CURL-CVE-2020-8285, DEBIAN-CVE-2020-8285, ECHO-52fa-da93-892e, GHSA-4p2h-jggv-23jg and 2 more.