CVE-2020-8286: 
Splunk Forwarder vulnerability analysis and mitigation

CVE-2020-8286 affects curl versions 7.41.0 through 7.73.0. The vulnerability is related to insufficient verification of OCSP (Online Certificate Status Protocol) response in libcurl when using OpenSSL as TLS backend. When OCSP stapling is enabled via CURLOPT_SSL_VERIFYSTATUS option or --cert-status command line option, libcurl failed to properly verify that the OCSP response matches the correct certificate (Curl Advisory).

The vulnerability exists in libcurl's OCSP stapling verification functionality. As part of the OCSP response verification process, a client should verify that the response corresponds to the correct certificate. This verification step was not performed by libcurl when built or configured to use OpenSSL as the TLS backend. The OCSP response checker function was updated to verify that the certificate id matches the correct one (Curl Advisory).

This vulnerability could allow an attacker who has compromised a TLS server to provide a fraudulent OCSP response that would appear valid, even if the original certificate has been revoked. This could enable the attacker to bypass certificate revocation checks (Curl Advisory).

The vulnerability requires OCSP stapling to be explicitly enabled, as it is not enabled by default in libcurl. It affects OCSP stapling when used with any TLS-based protocols supported by curl, including HTTPS, FTPS, SMTPS, POP3S, IMAPS, HTTPS-proxy and more (Curl Advisory).

The issue was fixed in curl version 7.74.0. Users should upgrade to this version or later. The OCSP response checker function was modified to also verify that the certificate id is correct. For users who cannot upgrade immediately, disabling OCSP stapling would prevent exploitation of this vulnerability (Curl Advisory, Debian Advisory).

Multiple vendors and distributions issued security advisories and patches for this vulnerability, including Apple, Debian, Red Hat, Oracle and others. The vulnerability was assigned a CVSS v3.1 Base Score of 7.5 (HIGH) by various organizations (Oracle Advisory, NetApp Advisory).