SB2020111306 - Red Hat Enterprise Linux 7 update for curl
Published: November 13, 2020
Security Bulletin ID
SB2020111306
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Data manipulation
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Improper Neutralization of HTTP Headers for Scripting Syntax (CVE-ID: CVE-2020-8177)
The vulnerability allows a remote attacker to overwrite files on the victim's system.
The vulnerability exists due to a logical error when processing Content-Disposition: HTTP response header in curl when executed with the -J flag and -i flags in the same command line. A remote attacker can trick the victim to run a specially crafted curl command against a malicious website and overwrite files on the user's system.
Remediation
Install update from vendor's website.