{"id":"CVE-2020-8177","aliases":["ALPINE-CVE-2020-8177","BELL-CVE-2020-8177","CURL-CVE-2020-8177","DEBIAN-CVE-2020-8177","DLA-2295-1","DSA-4881-1","EUVD-2020-29059","GHSA-wqc8-jpfx-w9g4","JLSEC-2026-1331","MGASA-2020-0282","RHSA-2020:4599","RHSA-2020:5002","RHSA-2020:5417","SUSE-SU-2020:14409-1","SUSE-SU-2020:1732-1","SUSE-SU-2020:1733-1","SUSE-SU-2020:1734-1","SUSE-SU-2020:1735-1","SUSE-SU-2020:1773-1","UBUNTU-CVE-2020-8177","USN-4402-1","openSUSE-SU-2020:0883-1","openSUSE-SU-2020:0908-1"],"status":"published","title":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other...","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01288,"percentile":0.70434,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-74","CWE-99"],"published":"2020-06-24T00:00:00Z","modified":"2026-10-26T12:02:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"curl","fixed_in":["7.66.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"curl","fixed_in":["7.67.0-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"curl","fixed_in":["7.69.1-r1"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"curl","fixed_in":["7.71.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"curl","fixed_in":["7.64.0-r4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"curl","fixed_in":["7.72.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"curl","fixed_in":["7.52.1-5+deb9u11"],"sources":["osv"]},{"ecosystem":"Julia","package":"LibCURL_jll","fixed_in":["7.71.1+0"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.61.1-14.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","fixed_in":["0:7.29.0-59.el7_9.1"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debuginfo","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debugsource","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-minimal-debuginfo","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-debuginfo","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-devel","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal-debuginfo","fixed_in":["0:7.61.1-12.el8_2.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","fixed_in":["7.37.0-70.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"curl","fixed_in":["7.37.0-70.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"curl","fixed_in":["7.37.0-70.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 5","package":"curl","fixed_in":["7.37.0-37.47.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","fixed_in":["7.60.0-11.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","fixed_in":["7.60.0-11.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","fixed_in":["7.60.0-11.3.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"curl","fixed_in":["7.60.0-4.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"curl","fixed_in":["7.60.0-4.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","fixed_in":["7.60.0-4.15.2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"curl","fixed_in":["7.60.0-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","fixed_in":["7.60.0-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","fixed_in":["7.60.0-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","fixed_in":["7.60.0-3.29.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","fixed_in":["7.60.0-3.29.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","fixed_in":["7.35.0-1ubuntu2.20+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"curl","fixed_in":["7.47.0-1ubuntu2.15"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"curl","fixed_in":["7.58.0-2ubuntu3.9"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"curl","fixed_in":["7.68.0-1ubuntu2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"curl","fixed_in":["7.60.0-lp151.5.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"curl-mini","fixed_in":["7.60.0-lp151.5.12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.66.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.67.0-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.69.1-r1"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.71.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.20.0"},{"fixed":"7.64.0-r4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.72.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.52.1-5+deb9u11"}]}],"versions":["7.52.1-5","7.52.1-5+deb9u1","7.52.1-5+deb9u10","7.52.1-5+deb9u2","7.52.1-5+deb9u3","7.52.1-5+deb9u4","7.52.1-5+deb9u5","7.52.1-5+deb9u6","7.52.1-5+deb9u7","7.52.1-5+deb9u8","7.52.1-5+deb9u9"]},{"source":"osv","ecosystem":"Debian:10","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.64.0-4+deb10u2"}]}],"versions":["7.64.0-4","7.64.0-4+deb10u1"],"bundled":8},{"source":"osv","ecosystem":"Julia","package":"LibCURL_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"7.71.1+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.71.0-1.mga7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-14.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.29.0-59.el7_9.1"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"curl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:8.2::baseos","package":"libcurl-minimal-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.61.1-12.el8_2.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"curl-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Point of Sale 11 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-70.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3-BCL","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.37.0-37.47.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-4.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-11.3.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-4.15.2"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.29.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-3.29.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm4"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.15"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.9"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.1"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.35.0-1ubuntu2.20+esm4"}]}],"versions":["7.32.0-1ubuntu1","7.33.0-1ubuntu1","7.34.0-1ubuntu1","7.35.0-1ubuntu1","7.35.0-1ubuntu2","7.35.0-1ubuntu2.1","7.35.0-1ubuntu2.2","7.35.0-1ubuntu2.3","7.35.0-1ubuntu2.5","7.35.0-1ubuntu2.6","7.35.0-1ubuntu2.7","7.35.0-1ubuntu2.8","7.35.0-1ubuntu2.9","7.35.0-1ubuntu2.10","7.35.0-1ubuntu2.11","7.35.0-1ubuntu2.12","7.35.0-1ubuntu2.13","7.35.0-1ubuntu2.14","7.35.0-1ubuntu2.15","7.35.0-1ubuntu2.16","7.35.0-1ubuntu2.17","7.35.0-1ubuntu2.19","7.35.0-1ubuntu2.20","7.35.0-1ubuntu2.20+esm2","7.35.0-1ubuntu2.20+esm3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.47.0-1ubuntu2.15"}]}],"versions":["7.43.0-1ubuntu2","7.45.0-1ubuntu1","7.46.0-1ubuntu1","7.47.0-1ubuntu1","7.47.0-1ubuntu2","7.47.0-1ubuntu2.1","7.47.0-1ubuntu2.2","7.47.0-1ubuntu2.3","7.47.0-1ubuntu2.4","7.47.0-1ubuntu2.5","7.47.0-1ubuntu2.6","7.47.0-1ubuntu2.7","7.47.0-1ubuntu2.8","7.47.0-1ubuntu2.9","7.47.0-1ubuntu2.11","7.47.0-1ubuntu2.12","7.47.0-1ubuntu2.13","7.47.0-1ubuntu2.14"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.58.0-2ubuntu3.9"}]}],"versions":["7.55.1-1ubuntu2","7.55.1-1ubuntu2.1","7.57.0-1ubuntu1","7.58.0-2ubuntu1","7.58.0-2ubuntu2","7.58.0-2ubuntu3","7.58.0-2ubuntu3.1","7.58.0-2ubuntu3.2","7.58.0-2ubuntu3.3","7.58.0-2ubuntu3.5","7.58.0-2ubuntu3.6","7.58.0-2ubuntu3.7","7.58.0-2ubuntu3.8"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.68.0-1ubuntu2.1"}]}],"versions":["7.65.3-1ubuntu3","7.65.3-1ubuntu4","7.66.0-1ubuntu1","7.67.0-2ubuntu1","7.68.0-1ubuntu1","7.68.0-1ubuntu2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.66.0-lp152.3.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp151.5.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"curl-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.60.0-lp151.5.12.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fujitsu","product":"m10-1_firmware"},{"vendor":"fujitsu","product":"m10-4_firmware"},{"vendor":"fujitsu","product":"m10-4s_firmware"},{"vendor":"fujitsu","product":"m12-1_firmware"},{"vendor":"fujitsu","product":"m12-2_firmware"},{"vendor":"fujitsu","product":"m12-2s_firmware"},{"vendor":"haxx","product":"curl"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"sinec_infrastructure_network_services"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"splunk","product":"universal_forwarder"}],"references":[{"url":"https://hackerone.com/reports/887462","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web"]},{"url":"https://curl.se/docs/CVE-2020-8177.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://www.debian.org/security/2021/dsa-4881","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-389290.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8177","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wqc8-jpfx-w9g4"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-8177","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2020-8177","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8177","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0282.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26858","tags":["report"]},{"url":"https://curl.haxx.se/docs/CVE-2020-8169.html","tags":["advisory"]},{"url":"https://curl.haxx.se/docs/CVE-2020-8177.html","tags":["advisory","article"]},{"url":"https://curl.haxx.se/changes.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:4599","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1847915","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1854369","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4599.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8177","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8177","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5002","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5002.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:5417","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1900103","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_5417.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-202014409-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173027","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8177","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201732-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201733-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1173026","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8169","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201734-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201735-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20201773-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8177","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4402-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8169","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/WOMRJVNHOQXH3HGQNKNOII35LAMOSNKQ/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GFJDBNWLSCZKQ5JEJ2A4C3FF2CBGRWWA/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T19:42:16Z","modified":"2026-10-14T08:18:09.238Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-99"],"updated_at":"2026-11-02T14:35:50.88562Z"}],"euvd":[{"id":"EUVD-2020-29059","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T19:42:16Z","modified":"2026-10-14T08:18:09Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:17.374818Z"}],"ghsa":[{"id":"GHSA-wqc8-jpfx-w9g4","title":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other...","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2022-05-24T17:36:21Z","modified":"2026-10-14T09:31:30Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","level":"high"}],"cwes":["CWE-74","CWE-99"],"updated_at":"2026-11-02T15:13:22.867821Z"}],"nvd":[{"id":"CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T20:15:13.497Z","modified":"2026-10-14T09:17:19.793Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-99","CWE-74"],"updated_at":"2026-11-02T14:06:27.73474Z"}],"osv":[{"id":"ALPINE-CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T20:15:13.497Z","modified":"2026-10-26T11:17:55.182713818Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"BELL-CVE-2020-8177","title":"CVE-2020-8177 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:39.131323Z","modified":"2026-01-26T09:48:34.671775Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T20:15:13.497Z","modified":"2026-10-24T10:31:04.745058332Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-12-14T20:15:13.497Z","modified":"2026-10-26T12:02:51.629664Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"JLSEC-2026-1331","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2026-08-17T13:15:13.4Z","modified":"2026-08-17T13:30:04.501568952Z","cvss":[{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2020:4599","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T04:36:50Z","modified":"2026-06-29T10:32:37Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5002","title":"Red Hat Security Advisory: curl security update","status":"published","published":"2024-09-16T04:36:59Z","modified":"2026-06-29T10:32:53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:5417","title":"Red Hat Security Advisory: curl security and bug fix update","status":"published","published":"2024-09-16T04:37:06Z","modified":"2026-06-29T10:33:12Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2020-8177","description":"curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used.","status":"published","published":"2020-06-24T00:00:00Z","modified":"2026-04-27T09:11:46.691125Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"CURL-CVE-2020-8177","title":"curl overwrite local file with -J","description":"curl can be tricked by a malicious server to overwrite a local file when using\n`-J` (`--remote-header-name`) and `-i` (`--include`) in the same command line.\n\nThe command line tool offers the `-J` option that saves a remote file using\nthe filename present in the `Content-Disposition:` response header. curl then\nrefuses to overwrite an existing local file using the same name, if one\nalready exists in the current directory.\n\nThe `-J` flag is designed to save a response body, and so it does not work\ntogether with `-i` and there is logic that forbids it. However, the check is\nflawed and does not properly check for when the options are used in the\nreversed order: first using `-J` and then `-i` were mistakenly accepted.\n\nThe result of this mistake was that incoming HTTP headers could overwrite a\nlocal file if one existed, as the check to avoid the local file was done first\nwhen body data was received, and due to the mistake mentioned above, it could\nalready have received and saved headers by that time.\n\nThe saved file would only get response headers added to it, as it would abort\nthe saving when the first body byte arrives. A malicious server could however\nstill be made to send back virtually anything as headers and curl would save\nthem like this, until the first CRLF-CRLF sequence appears.\n\n(Also note that `-J` needs to be used in combination with `-O` to have any\neffect.)","status":"published","published":"2020-06-24T08:00:00Z","modified":"2026-10-25T01:04:50.472675176Z","updated_at":"2026-11-02T15:43:55.669514Z"},{"id":"DLA-2295-1","title":"curl - security update","status":"published","published":"2020-07-28T00:00:00Z","modified":"2026-03-09T01:21:35.429854Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DSA-4881-1","title":"curl - security update","status":"published","published":"2021-03-30T00:00:00Z","modified":"2026-03-09T02:10:40.275019Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2020-0282","title":"Updated curl packages fix security vulnerability","description":"Updated curl packages fix security vulnerabilities:\n\nlibcurl can be tricked to prepend a part of the password to the host name\nbefore it resolves it, potentially leaking the partial password over the\nnetwork and to the DNS server(s) (CVE-2020-8169).\n\ncurl can be tricked by a malicious server to overwrite a local file when\nusing -J (--remote-header-name) and -i (--include) in the same command\nline (CVE-2020-8177).\n\nThe curl package has been updated to version 7.71.0, fixing these issues\nand other bugs.\n","status":"published","published":"2020-07-05T19:48:23Z","modified":"2026-04-16T04:44:24.572605264Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0883-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\t  \n- CVE-2020-8169: Fixed an issue where could have led to partial password leak   \n  over DNS on HTTP redirect (bsc#1173026).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2020-06-27T16:16:16Z","modified":"2026-02-04T02:34:21.76213Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0908-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-06-29T18:19:59Z","modified":"2026-02-04T02:19:17.544172Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"SUSE-SU-2020:14409-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027). \t  \n","status":"published","published":"2020-06-24T07:45:33Z","modified":"2025-05-02T04:10:23.493599Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1732-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious server to overwrite a local file when using the -J option (bsc#1173027).\n","status":"published","published":"2020-06-24T07:43:22Z","modified":"2026-02-04T02:21:08.580617Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1733-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\t  \n- CVE-2020-8169: Fixed an issue where could have led to partial password leak   \n  over DNS on HTTP redirect (bsc#1173026).\n","status":"published","published":"2020-06-24T07:43:40Z","modified":"2026-02-04T03:50:29.704559Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1734-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\t  \n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\n","status":"published","published":"2020-06-24T07:44:03Z","modified":"2026-02-04T03:22:42.912174Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1735-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\t  \n","status":"published","published":"2020-06-24T07:44:27Z","modified":"2026-02-04T03:13:23.240644Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2020:1773-1","title":"Security update for curl","description":"This update for curl fixes the following issues:\n\n- CVE-2020-8177: Fixed an issue where curl could have been tricked by a malicious \n  server to overwrite a local file when using the -J option (bsc#1173027).\n","status":"published","published":"2020-06-26T06:06:20Z","modified":"2026-02-04T02:48:19.295206Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"USN-4402-1","title":"curl vulnerabilities","description":"Marek Szlagor, Gregory Jefferis and Jeroen Ooms discovered\nthat curl incorrectly handled certain credentials. An attacker\ncould possibly use this issue to expose sensitive information.\nThis issue only affected Ubuntu 19.10 and Ubuntu 20.04 LTS.\n(CVE-2020-8169)\n\nIt was discovered that curl incorrectly handled certain parameters.\nAn attacker could possibly use this issue to overwrite a local file.\n(CVE-2020-8177)\n","status":"published","published":"2020-06-24T11:51:31Z","modified":"2026-06-29T13:48:03.504007124Z","updated_at":"2026-11-02T16:58:14.547547Z"}]}}