Ah, the fix is out! curl https://culr.se/cve-fix | sudo bash aw crap ...
Ha ha ha, so silly.
Just fetch the source code using git.
Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
21–30 of 106 posts
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#22Ouch! Percentage of internet of things devices who don't ship libcurl is a rounding error. Percentage of internet of things devices that patch libcurl is also a rounding error.
I have the feeling that this is gonna be way bigger than the log4j mess.
For the most part it's not common to be able to make a server call curl with an arbitrary server which is usually required to exploit this sort of thing. There will be some vulnerable apps, but the vast majority of servers with this vulnerability present won't be exploitable in any practical sense.
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#23Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#24C software really needs to be used in a sandbox because this stuff is inevitable.
In this networked world, it really is a terrible language, there is no excuse for it
The only authority this program should have is network access, some compute time and permission to create and write to one or more files. Nothing more.
Though this is where almost all of our currently popular programming languages and operating systems are failing. They are fundamentally broken. Just on account of security, monolithic kernels are a terrible idea. And sandboxing hasn't even been an afterthought in most languages and virtual machines. Even on the hardware level, secure compartmentalization and access mechanisms are a joke.
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#25I kinda hate doing things this way... Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that... But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover the…
I mean i did just put it on the calendar with a note to update and deploy... so yeah kinda a digital finger ready to push the button as a result of this post...
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#26I kinda hate doing things this way... Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that... But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover the…
I think current way is better
This way admins and ppl can prepare.
If you release fix and cve at the same time then race between bad actors and ppl starts
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#27I kinda hate doing things this way... Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that... But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover the…
It really is insane how much you have to tip toe around tech circles just to say anything that isn't part of the colloquial circle jerk.
What you're saying is the approach any competent software company takes to managing vulnerabilities. There's zero reason to write a prior notice that there's a flaw because it would cause panic and allow opportunities to exploit the flaw (((before there's a fix.))) This is the whole premise around 'responsible disclosure' and why every company wants security researchers to abide by it.
The only logical conclusion I can draw here is curls notice is not responsible.
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#28I kinda hate doing things this way... Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that... But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover the…
I think current way is better This way admins and ppl can prepare. If you release fix and cve at the same time then race between bad actors and ppl starts
And now the race has started with admins not being able to do anything. Anyone that knows of this vulnerability has enough time for a last hurray to exploit it as much as possible.
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#29Sad to see this just a month and a half from this post: https://daniel.haxx.se/blog/2023/08/26/cve-2020-19909-is-eve... Is the CVE system unreasonably alarmistic or is C unpredictable with flaws?
Both of those things are true. Many CVEs are unimportant, but serious security vulnerabilities do exist, and are very hard to avoid entirely when writing C.
Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
#30C software really needs to be used in a sandbox because this stuff is inevitable.
I’m gonna start referring to these types of comments as ‘drive by rust evangelists’
Go write your own memory safe curl if one _actual_ vuln in 10 years is not within your risk appetite.