Mythos Finds a Curl Vulnerability
daniel.haxx.se
Mythos Finds a Curl Vulnerability
1–10 of 298 posts
Re: Mythos Finds a Curl Vulnerability
#2Putting on my tinfoil-hat: Sooo, the guy who runs the test and delivers the report could just have removed the more interesting bugs and delivered those to any three letter agency?
Re: Mythos Finds a Curl Vulnerability
#3Quote:
"My personal conclusion can however not end up with anything else than that the big hype around this model so far was primarily marketing. I see no evidence that this setup finds issues to any particular higher or more advanced degree than the other tools have done before Mythos. Maybe this model is a little bit better, but even if it is, it is not better to a degree that seems to make a significant dent in code analyzing."
It's a good reminder for us all that the competition in this space is rough and lots of more or less subtle marketing is involved.
Re: Mythos Finds a Curl Vulnerability
#4> The single confirmed vulnerability is going to end up a severity low CVE planned to get published in sync with our pending next curl release 8.21.0 in late June
My mind still cannot understand the quality and refinement that's gone into cURL. It really is the perfect example of something done so right, that people barely think twice about.
Re: Mythos Finds a Curl Vulnerability
#5> The source code consists of 660,000 words, which is 12% more words than the entire English edition of the novel War and Piece.
Typo, or is there a spoof I should go read?
Re: Mythos Finds a Curl Vulnerability
#6Putting on my tinfoil-hat: Sooo, the guy who runs the test and delivers the report could just have removed the more interesting bugs and delivered those to any three letter agency?
[flagged]
Re: Mythos Finds a Curl Vulnerability
#7> Not particularly “dangerous”
I'm not sure that follows. As noted, curl was already analyzed to death with every tool available; most software isn't at that level.
Re: Mythos Finds a Curl Vulnerability
#8Putting on my tinfoil-hat: Sooo, the guy who runs the test and delivers the report could just have removed the more interesting bugs and delivered those to any three letter agency?
[flagged]
Curl is likely one of the very much more combed over pieces of code at this point. It feels like it has some special draw for people looking for vulnerabilities. Not that it doesn't mean some novel idea can't be looked or checked still.
Re: Mythos Finds a Curl Vulnerability
#9> Not particularly “dangerous” I'm not sure that follows. As noted, curl was already analyzed to death with every tool available; most software isn't at that level.
I don't think I understand what you mean, the "not particularly dangerous" comment was in relation to the vulnerability that was found right ? Surely they would know what constitutes a lower severity level.
Re: Mythos Finds a Curl Vulnerability
#10> Not particularly “dangerous” I'm not sure that follows. As noted, curl was already analyzed to death with every tool available; most software isn't at that level.
I don't think I understand what you mean, the "not particularly dangerous" comment was in relation to the vulnerability that was found right ? Surely they would know what constitutes a lower severity level.
My guess is that it is in category of "you are holding it wrong". Still worth fixing, but requires very specific user input for example. Or very weird scenario. Or in some less used protocol or flag combination.