CVE-2020-8177
Description
A flaw was found in curl. Overwriting local files is possible when using a certain combination of command line options. Requesting content from a malicious server could lead to overwriting local files with compromised files leading to unknown effects. The highest threat from this vulnerability is to file integrity.
Statement
This issue only affects the 'curl' command line utility. Additionally, this is only an issue when using the '-J' (with the '-O' option) and '-i' command line options combined.
In most cases, there is nothing to gain for a local attacker here: the curl command line utility is likely running with the same privileges as the user, and thus the user can already overwrite all the files curl could overwrite. However, a local user will have to call curl with the '-J' and '-i' command line options while requesting content from a malicious server, which then opens up an opportunity for the malicious server to overwrite local files.
Mitigation
The vulnerability is only possible when using the '-J' and '-i' switches in conjunction with the curl command. Executing curl without these switches mitigates the flaw.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.4 | 7.8 | 7.8 |
| Attack Vector | Network | Local | Local |
| Attack Complexity | High | Low | Low |
| Privileges Required | Low | Low | Low |
| User Interaction | Required | None | None |
| Scope | Unchanged | Unchanged | Unchanged |
| Confidentiality | None | High | High |
| Integrity Impact | High | High | High |
| Availability Impact | Low | High | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat CVSS v3 Score Explanation
'Access vector' has been set to network, as there's still a malicious server involved. 'Access complexity' has been set to high and 'User interaction' has been set to required, as it requires a victim to use an uncommon combination of command line arguments in combination with a request to a malicious server. 'Availability' has been set to low, because the files that can be overwritten by the malicious server are under various constraints (for example, the victim would need to have write access to the target file, the name needs to be known, the content written is not under arbitrary control).
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
