Curl 7.51.0 Released • Hacker News Board

Re: Curl 7.51.0 Released

#21

Post by dorfsmay » Wed, Nov 02, 2016, 11:32 AM UTC

du_bing wrote: post #3

What is the biggest usage of Curl? I am new to Linux,sorry.

It's used to send an http/HTTPS reqeuests, controlling every aspect of it, form headers to cookies, to ignoring/not SSL certs, and has advanced debugging option to show you the entire dialog (-sv) and use a different IP address (--resolve to test you firewalls, LBs etc...).

Re: Curl 7.51.0 Released

#22

Post by IsmaOlvey » Wed, Nov 02, 2016, 11:54 AM UTC

teh_klev wrote: post #19

kinow wrote: post #2

Change log for this release Fixed in 7.51.0 - November 2 2016 Changes: nss: additional cipher suites are now accepted by CURLOPT_SSL_CIPHER_LIST New option: CURLOPT_KEEP_SENDING_ON_ERROR Bugfixes: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curl_maprintf CVE-2016-8619: double-f…

Why repeat this here in an inferior format?

Because the commenter perceived that some people only read the comments (or read the comments first).

Re: Curl 7.51.0 Released

#23

Post by mitchtbaum » Wed, Nov 02, 2016, 12:02 PM UTC

Those looking from a "reimplement it in Rust" angle may like:

* https://github.com/hyperium/hyper/

* https://github.com/lukaszwawrzyk/rust-wget

* https://github.com/tokio-rs/tokio-curl

Re: Curl 7.51.0 Released

#24

Post by 80x25 » Wed, Nov 02, 2016, 12:20 PM UTC

mitchtbaum wrote: post #23

Those looking from a "reimplement it in Rust" angle may like: * https://github.com/hyperium/hyper/ * https://github.com/lukaszwawrzyk/rust-wget * https://github.com/tokio-rs/tokio-curl

tokio-curl uses libcurl internally

Re: Curl 7.51.0 Released

#25

Post by fuhrysteve » Wed, Nov 02, 2016, 1:18 PM UTC

Does anyone have an abbreviated explanation of what the security vulnerabilities that were addressed here? I recall there was a very ominous post to look out for this release because of some nasty stuff they found.

Re: Curl 7.51.0 Released

#26

Post by sdeziel » Wed, Nov 02, 2016, 2:02 PM UTC

neic wrote: post #13

I see that Ubuntu 16.04 LTS have version 7.47.0 [1]. Its been 9 months, 9 releases and at least 15 CVEs since then. I can also see that some of the CVEs was reported to distros@openwall [2]. I (naively) assumed that once this was reported, the package maintainers would update the packages, push a release at the same time as the original developer made a public statement. Then I could just update my system and be done…

You can get an overview of the various CVEs affecting curl: https://people.canonical.com/~ubuntu-security/cve/pkg/curl.h...

Re: Curl 7.51.0 Released

#27

Post by mitchtbaum » Wed, Nov 02, 2016, 2:28 PM UTC

80x25 wrote: post #24

mitchtbaum wrote: post #23

Those looking from a "reimplement it in Rust" angle may like: * https://github.com/hyperium/hyper/ * https://github.com/lukaszwawrzyk/rust-wget * https://github.com/tokio-rs/tokio-curl

tokio-curl uses libcurl internally

Yes. I linked it to show how a web client can run requests in parallel using Rust's tokio and futures libraries. If anyone makes a similar implementation, it might go in tokio-hyper/examples ( https://github.com/tokio-rs/tokio-hyper/tree/master/examples ) or near rust-wget to add more of wget and curl's wrapped functionality.

Re: Curl 7.51.0 Released

#28

Post by geofft » Wed, Nov 02, 2016, 2:42 PM UTC

neic wrote: post #13

I see that Ubuntu 16.04 LTS have version 7.47.0 [1]. Its been 9 months, 9 releases and at least 15 CVEs since then. I can also see that some of the CVEs was reported to distros@openwall [2]. I (naively) assumed that once this was reported, the package maintainers would update the packages, push a release at the same time as the original developer made a public statement. Then I could just update my system and be done…

If you go to the "Ubuntu Changelog" link on the right, you can see that they've backported three security fixes (CVE-2016-5419, CVE-2016-5420, and CVE-2016-5421) since the 16.04 LTS release.

You are trusting Ubuntu's judgment that the remaining 12 CVEs aren't that important. Ubuntu's security team is pretty good, but I don't think there is any distro that is extremely good. In part this is because a distro is on the hook for compatibility of all the software they ship, and expected to prioritize compatibility over security. Anything other than targeted security fixes can cause regressions.

Re: Curl 7.51.0 Released

#29

Post by 0xmohit » Wed, Nov 02, 2016, 2:42 PM UTC

du_bing wrote: post #3

What is the biggest usage of Curl? I am new to Linux,sorry.

I find it very useful for debugging. For example, when you have a web server that redirects requests saying:

  curl --verbose --location URL

or even

  curl --trace --location URL

provides the desired information.

Re: Curl 7.51.0 Released

#30

Post by LeonM » Wed, Nov 02, 2016, 2:43 PM UTC

teh_klev wrote: post #19

kinow wrote: post #2

Change log for this release Fixed in 7.51.0 - November 2 2016 Changes: nss: additional cipher suites are now accepted by CURLOPT_SSL_CIPHER_LIST New option: CURLOPT_KEEP_SENDING_ON_ERROR Bugfixes: CVE-2016-8615: cookie injection for other servers CVE-2016-8616: case insensitive password comparison CVE-2016-8617: OOB write via unchecked multiplication CVE-2016-8618: double-free in curl_maprintf CVE-2016-8619: double-f…

Why repeat this here in an inferior format?

I think this format is superior for mobile users, it gives them only the relevant information in just a few kB of data.

In this case, haxx.se is not that bad, but many news sites present so much ads, overlays, non-responsive UI, dark UI etc etc that most mobile browsers crash, and loading takes forever due to 10+mb of ads on a 3G connection just to display 20 lines of information.