CVE-2020-8286: haxx libcurl +16 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2020-8286

CVSS 7.5 · High EPSS 4,6%

Kerentanan Improper Certificate Validation pada haxx libcurl, fedoraproject fedora +15 lainnya. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Rincian

Terbit di NVD: 14 Desember 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-295: Improper Certificate Validation
EPSS (30 hari): 4,6% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
haxx	libcurl	Versi 7.41.0 hingga sebelum 7.74.0
fedoraproject	fedora	Versi 32
fedoraproject	fedora	Versi 33
debian	debian linux	Versi 9.0
debian	debian linux	Versi 10.0
netapp	clustered data ontap	Semua versi
netapp	hci management node	Semua versi
netapp	solidfire	Semua versi
netapp	hci bootstrap os	Semua versi
netapp	hci storage node firmware	Semua versi
apple	mac os x	Semua versi sebelum 10.14.6
apple	mac os x	Versi 10.15 hingga sebelum 10.15.7
apple	mac os x	Versi 10.14.6
apple	mac os x	Versi 10.14.6 security_update_2019-001
apple	mac os x	Versi 10.14.6 security_update_2019-002
apple	mac os x	Versi 10.14.6 security_update_2020-001
apple	mac os x	Versi 10.14.6 security_update_2020-002
apple	mac os x	Versi 10.14.6 security_update_2020-003
apple	mac os x	Versi 10.14.6 security_update_2020-004
apple	mac os x	Versi 10.14.6 security_update_2020-005
apple	mac os x	Versi 10.14.6 security_update_2020-006
apple	mac os x	Versi 10.14.6 security_update_2020-007
apple	mac os x	Versi 10.14.6 security_update_2021-001
apple	mac os x	Versi 10.15.7
apple	mac os x	Versi 10.15.7 security_update_2020-001
apple	mac os x	Versi 10.15.7 security_update_2021-001
apple	mac os x	Versi 10.15.7 supplemental_update
apple	macos	Versi 11.0 hingga sebelum 11.3
siemens	simatic tim 1531 irc firmware	Semua versi hingga 2.2
siemens	sinec infrastructure network services	Semua versi sebelum 1.0.1.1
oracle	communications billing and revenue management	Versi 12.0.0.3.0
oracle	communications cloud native core policy	Versi 1.14.0
oracle	essbase	Versi 21.2
oracle	peoplesoft enterprise peopletools	Versi 8.58
splunk	universal forwarder	Versi 8.2.0 hingga sebelum 8.2.12
splunk	universal forwarder	Versi 9.0.0 hingga sebelum 9.0.6
splunk	universal forwarder	Versi 9.1.0

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://curl.se/docs/CVE-2020-8286.html advisory vendor
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf patch · advisory pihak ketiga
https://hackerone.com/reports/1048457 exploit · patch · advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
http://seclists.org/fulldisclosure/2021/Apr/50 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2021/Apr/51 mailing list · advisory pihak ketiga
http://seclists.org/fulldisclosure/2021/Apr/54 mailing list · advisory pihak ketiga
https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf advisory pihak ketiga
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4A... mailing list · advisory pihak ketiga
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHM... mailing list · advisory pihak ketiga
https://security.gentoo.org/glsa/202012-14 advisory pihak ketiga
https://security.netapp.com/advisory/ntap-20210122-0007/ advisory pihak ketiga
https://support.apple.com/kb/HT212325 advisory pihak ketiga
https://support.apple.com/kb/HT212326 advisory pihak ketiga
https://support.apple.com/kb/HT212327 advisory pihak ketiga
https://www.debian.org/security/2021/dsa-4881 advisory pihak ketiga
https://www.oracle.com//security-alerts/cpujul2021.html advisory pihak ketiga
https://www.oracle.com/security-alerts/cpuApr2021.html advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.