WaratekVRT Sign in

CVE-2020-8286

Affected software5 products, listed below
Severity7.5 High CVSS 3.1 2 scores
WeaknessCWE-295
Published14 Dec 2020
Updated14 Oct 2026

Description

curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.

Exploitation status

No public exploit

No exploit has been reported in the sources we check. Published 5 years ago.
  • CISA KEV not listed
  • VulnCheck KEV not listed
  • CISA Vulnrichment exploitation: none
  • Indexed PoC none indexed
  • EPSS 4.6% chance in 30 days

Waratek protection

Outside Waratek scope

A Java vulnerability, but not one Waratek protects. It affects only Java on a user's desktop (applets, Web Start, JavaFX, the installer), sits in a product the Waratek agent can't be installed into, or is in a package we don't expect in business applications. The decision below says which.

  • Protection none
  • Action not pursued none
  • Review human Researcher
  • Record active
Decided by Manual classification of this CVE in the legacy dataset
Finding A manual classification set this CVE's status to Outside Waratek scope, but the CVE names a tracked product.

CVSS

7.5 HIGH v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N 2 metrics

We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.

VersionScoreBandVectorAssignerType
CVSS 3.1 7.5 HIGH CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N NVD Primary published
CVSS 2.0 5.0 none AV:N/AC:L/Au:N/C:N/I:P/A:N NVD Primary

Affected software and releases

Oracle advisories

AdvisoryTypeQuarterProducts Oracle names in its risk matrix
Oracle Critical Patch Update July 2021 ↗ CPU 2021-Q3 Oracle Communications Applications / Balances (cURL) (12.0.0.3.0)
Oracle Critical Patch Update April 2021 ↗ CPU 2021-Q2 Oracle PeopleSoft / File Processing (cURL) (8.58)

Oracle components and versions

FamilyComponentVersions, as Oracle lists themRead as
Oracle Communications Applications Balances (cURL) 12.0.0.3.0 12.0.0.3.0
Oracle PeopleSoft File Processing (cURL) 8.58 8.58

Products and versions

17 products, 37 version entries
SourceVendorProductSchemeAffected versions
nvd apple mac os x generic 10.14.6 · ＜ 10.14.6 · 10.14.6:security_update_2019-001 · 10.14.6:security_update_2019-002 · 10.14.6:security_update_2020-001 · 10.14.6:security_update_2020-002 · 10.14.6:security_update_2020-003 · 10.14.6:security_update_2020-004 · 10.14.6:security_update_2020-005 · 10.14.6:security_update_2020-006 · 10.14.6:security_update_2020-007 · 10.14.6:security_update_2021-001 · ≥ 10.15 and ＜ 10.15.7 · 10.15.7 · 10.15.7:supplemental_update · 10.15.7:security_update_2020-001 · 10.15.7:security_update_2021-001
nvd apple macos generic ≥ 11.0 and ＜ 11.3
nvd debian debian linux generic 9.0 · 10.0
nvd fedoraproject fedora generic 32 · 33
nvd haxx libcurl generic ≥ 7.41.0 and ＜ 7.74.0
nvd netapp clustered data ontap generic any version
nvd netapp hci bootstrap os generic any version
nvd netapp hci management node generic any version
nvd netapp hci storage node firmware generic any version
nvd netapp solidfire generic any version
nvd oracle communications billing and revenue management generic 12.0.0.3.0
nvd oracle communications cloud native core policy generic 1.14.0
nvd oracle essbase generic 21.2
nvd oracle peoplesoft enterprise peopletools generic 8.58
nvd siemens simatic tim 1531 irc firmware generic ≤ 2.2
nvd siemens sinec infrastructure network services generic ＜ 1.0.1.1
nvd splunk universal forwarder generic ≥ 8.2.0 and ＜ 8.2.12 · ≥ 9.0.0 and ＜ 9.0.6 · 9.1.0

Earlier manual review

A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.

## Manual Classification Context **Labels:** HTTP, FILE PROCESSING (CURL), NO AUTH REMOTE EXPLOIT, BALANCES (CURL) **Products:** ORACLE PEOPLESOFT, PEOPLESOFT ENTERPRISE PEOPLETOOLS, ORACLE COMMUNICATIONS APPLICATIONS, CURL, ORACLE COMMUNICATIONS BILLING AND REVENUE MANAGEMENT

References

URLTags
http://seclists.org/fulldisclosure/2021/Apr/50 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/51 Mailing List, Third Party Advisory
http://seclists.org/fulldisclosure/2021/Apr/54 Mailing List, Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-200951.pdf Third Party Advisory
https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf Patch, Third Party Advisory
https://curl.se/docs/CVE-2020-8286.html Vendor Advisory
https://hackerone.com/reports/1048457 Exploit, Patch, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/12/msg00029.html Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DAEHE2S2QLO4AO4MEEYL75NB7SAH5PSL/ Mailing List, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NZUVSQHN2ESHMJXNQ2Z7T2EELBB5HJXG/ Mailing List, Third Party Advisory

Timeline
Published2020-12-14By the CVE Program.
NVD record modified2026-10-14NVD's own last-modified date for this record.