CVE-2020-8284: Apple Mac OS X

Low severity, CVSS 3.7. EPSS: 3.9% chance of exploitation in the next 30 days.

A malicious server can use the FTP PASV response to trick curl 7.73.0 and earlier into connecting back to a given IP address and port, and this way potentially make curl extract information about services that are otherwise private and not disclosed, for example doing port scanning and service banner extractions.

Affected products

  • Apple Mac OS X: from 10.14.0, before 10.14.6 (fixed in 10.14.6); from 10.15, before 10.15.7 (fixed in 10.15.7); version 10.14.6 only; version 10.15.7 only
  • Apple macOS: version 11.0.1 only; version 11.1 only; version 11.2 only
  • Debian Debian Linux: version 9.0 only; version 10.0 only
  • Fedoraproject Fedora: version 32 only; version 33 only
  • Fujitsu m10-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Fujitsu m10-4 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Fujitsu m10-4s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Fujitsu m12-1 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Fujitsu m12-2 Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Fujitsu m12-2s Firmware: before xcp2410 (fixed in xcp2410); before xcp3110 (fixed in xcp3110)
  • Haxx Curl: up to and including 7.73.0
  • Netapp Clustered Data Ontap: affected versions not specified
  • Netapp Hci Bootstrap OS: affected versions not specified
  • Netapp Hci Management Node: affected versions not specified
  • Netapp Hci Storage Node: affected versions not specified
  • Netapp Solidfire: affected versions not specified
  • Oracle Communications Billing And Revenue Management: version 12.0.0.3.0 only
  • Oracle Communications Cloud Native Core Policy: version 1.14.0 only
  • Oracle Essbase: version 21.2 only
  • Oracle PeopleSoft Enterprise PeopleTools: version 8.58 only
  • Siemens Sinec Infrastructure Network Services: before 1.0.1.1 (fixed in 1.0.1.1)
  • Splunk Universal Forwarder: from 8.2.0, before 8.2.12 (fixed in 8.2.12); from 9.0.0, before 9.0.6 (fixed in 9.0.6); version 9.1.0 only

Published 2020-12-14. Last modified 2026-06-17.