CVE-2020-8169
libcurl: partial password leak over DNS on HTTP redirect
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
curl 7.62.0 through 7.70.0 is vulnerable to an information disclosure vulnerability that can lead to a partial password being leaked over the network and to the DNS server(s).
curl versiones 7.62.0 hasta 7.70.0, es susceptible a una vulnerabilidad de divulgación de información que puede conllevar a que una contraseña parcial sea filtrada a través de la red y a servidor(es) DNS
A flaw was found in libcurl. A part of a password may be prepended to the host name before the host name is resolved, leading to a leak of the partial password over the network and to DNS servers. This highest threat from this vulnerability is to data confidentiality.
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products, and is packaged under Red Hat JBoss Core Services to allow for faster distribution of updates, and for a more consistent update experience. This release adds the new Apache HTTP Server 2.4.37 Service Pack 8 packages that are part of the JBoss Core Services offering. This release serves as a replacement for Red Hat JBoss Core Services Pack Apache Server 2.4.37 Service Pack 7 and includes bug fixes and enhancements. Issues addressed include null pointer and use-after-free vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-01-28 CVE Reserved
- 2020-06-24 CVE Published
- 2024-08-04 CVE Updated
- 2024-08-04 First Exploit
- 2025-05-04 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://hackerone.com/reports/874778 | 2024-08-04 |
| URL | Date | SRC |
|---|---|---|
| https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf | 2024-03-27 |
| URL | Date | SRC |
|---|---|---|
| https://curl.se/docs/CVE-2020-8169.html | 2024-03-27 | |
| https://www.debian.org/security/2021/dsa-4881 | 2024-03-27 | |
| https://access.redhat.com/security/cve/CVE-2020-8169 | 2021-06-17 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1847916 | 2021-06-17 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Siemens Search vendor "Siemens" | Simatic Tim 1531 Irc Firmware Search vendor "Siemens" for product "Simatic Tim 1531 Irc Firmware" | < 2.2 Search vendor "Siemens" for product "Simatic Tim 1531 Irc Firmware" and version " < 2.2" | - |
Affected
| in | Siemens Search vendor "Siemens" | Simatic Tim 1531 Irc Search vendor "Siemens" for product "Simatic Tim 1531 Irc" | - | - |
Safe
|
| Haxx Search vendor "Haxx" | Curl Search vendor "Haxx" for product "Curl" | >= 7.62.0 <= 7.70.0 Search vendor "Haxx" for product "Curl" and version " >= 7.62.0 <= 7.70.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 10.0 Search vendor "Debian" for product "Debian Linux" and version "10.0" | - |
Affected
| ||||||
| Siemens Search vendor "Siemens" | Sinec Infrastructure Network Services Search vendor "Siemens" for product "Sinec Infrastructure Network Services" | < 1.0.1.1 Search vendor "Siemens" for product "Sinec Infrastructure Network Services" and version " < 1.0.1.1" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Universal Forwarder Search vendor "Splunk" for product "Universal Forwarder" | >= 8.2.0 < 8.2.12 Search vendor "Splunk" for product "Universal Forwarder" and version " >= 8.2.0 < 8.2.12" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Universal Forwarder Search vendor "Splunk" for product "Universal Forwarder" | >= 9.0.0 < 9.0.6 Search vendor "Splunk" for product "Universal Forwarder" and version " >= 9.0.0 < 9.0.6" | - |
Affected
| ||||||
| Splunk Search vendor "Splunk" | Universal Forwarder Search vendor "Splunk" for product "Universal Forwarder" | 9.1.0 Search vendor "Splunk" for product "Universal Forwarder" and version "9.1.0" | - |
Affected
| ||||||