SB2021021903 - Information disclosure in curl implementation within Command Line Interface, EAV Monitors and iRules components in F5 BIG-IP products
Published: February 19, 2021
Security Bulletin ID
SB2021021903
Severity
Medium
Patch available
NO
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Information disclosure (CVE-ID: CVE-2020-8284)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way cURL handles PASV responses. A remote attacker with control over malicious FTP server can use the PASV response to trick curl into connecting
back to a given IP address and port, and this way potentially make curl
extract information about services that are otherwise private and not
disclosed, for example doing port scanning and service banner extractions.
Remediation
Cybersecurity Help is not aware of any official remediation provided by the vendor.