Critical Vulnerability in curl Package: Local File Overwrite Risk
Summary
ALPINE-CVE-2020-8177: curl 7.20.0 through 7.70.0 is vulnerable to improper restriction of names for files and other resources that can lead too overwriting a local file when the -J flag is used. Affects curl versions < 7.66.0-r1. Fixed in 7.66.0-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The curl package is a widely used command-line tool and library for transferring data with URLs. It supports various protocols including HTTP, HTTPS, FTP, and more. curl is essential for developers and system administrators for tasks such as downloading files, testing APIs, and automating web interactions. However, a vulnerability has been identified that could allow attackers to overwrite local files under certain conditions, compromising system integrity.
Vulnerability Detail
The vulnerability identified as CVE-2020-8177 affects curl versions 7.20.0 through 7.70.0. It arises from improper restrictions on file names when using the -J flag, which is intended to save files with the name specified by the server. This flaw can lead to overwriting local files, potentially allowing an attacker to manipulate or corrupt data. The CVSS score for this vulnerability is 7.8, indicating a high severity level, which necessitates immediate attention.
How To Fix
Minimum fixed version
7.66.0-r1
This is the first release that contains the fix.
sudo apk add --upgrade curlTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the -J flag when executing curl commands that may interact with untrusted sources. This will prevent the risk of local file overwriting until the package can be updated.
Conclusion
The CVE-2020-8177 vulnerability in the curl package poses a significant risk of local file overwriting, affecting multiple versions of the software. Users are strongly advised to update to the latest patched version to mitigate this risk. Until an update can be applied, avoiding the use of the -J flag is recommended as a temporary measure.
See every vulnerability recorded for curl →
FAQ
CVE-2020-8177 is a vulnerability in the curl package that allows for local file overwriting when the -J flag is used.
The vulnerability affects curl versions from 7.20.0 to 7.70.0.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If an immediate update is not possible, avoid using the -J flag in curl commands to mitigate the risk of file overwriting.
The CVSS score for CVE-2020-8177 is 7.8, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for curl.
