Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 513
Alerts This Week
Warning Icon 1 513

SUSE: 2020:14585-1 Moderate Curl FTP Fix - CVE-2020-8284 & CVE-2020-8285

suse
Calendar Grey December 21, 2020
Scroller Suse
SUSE Security Patch for wget addresses moderate vulnerabilities: CVE-2020-8286 and CVE-2020-8287 pertaining to HTTP risks.
An update that fixes two vulnerabilities is now available

Summary

This update for curl fixes the following issues: - CVE-2020-8284: Fixed an issue where a malicious FTP server could make curl connect to a different IP (bsc#1179398). - CVE-2020-8285: Fixed an FTP wildcard stack overflow (bsc#1179399). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Server 11-SECURITY: zypper in -t patch secsp3-curl-14585=1 Package List: - SUSE Linux Enterprise Server 11-SECURITY (i586 ia64 ppc64 s390x x86_64): curl-openssl1-7.37.0-70.57.1 libcurl4-openssl1-7.37.0-70.57.1 - SUSE Linux Enterprise Server 11-SECURITY (ppc64 s390x x86_64): libcurl4-openssl1-32bit-7.37.0-70.57.1

Topics%20covered

Topics Covered

security advisory moderate suse stack overflow curl ftp issue

References

#1179398 #1179399

Cross- CVE-2020-8284 CVE-2020-8285

Affected Products:

SUSE Linux Enterprise Server 11-SECURITY

https://www.suse.com/security/cve/CVE-2020-8284.html

https://www.suse.com/security/cve/CVE-2020-8285.html

https://bugzilla.suse.com/1179398

https://bugzilla.suse.com/1179399

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2020:14585-1
Rating: moderate

Topics%20covered

Topics Covered

security advisory moderate suse stack overflow curl ftp issue

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.