Curl/libcurl HIGH CVE-2023-38545 leaked early?

#1

Post by atyvr » Wed, Oct 11, 2023, 3:34 AM UTC

Curl/libcurl HIGH CVE-2023-38545 leaked early?
gitlab.com

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#2

Post by royce » Wed, Oct 11, 2023, 5:13 AM UTC

"[PATCH] socks: return error if hostname too long for remote resolve

Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that did not work as intended and caused a security issue."

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#3

Post by [deleted] » Wed, Oct 11, 2023, 6:00 AM UTC

[deleted]

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#4

Post by jo-m » Wed, Oct 11, 2023, 6:01 AM UTC

The CVE page on curl.se is also online as of now: https://curl.se/docs/CVE-2023-38545.html

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#5

Post by KirillPanov » Wed, Oct 11, 2023, 6:05 AM UTC

Wat.

So you can only be attacked if you're using a socks5 proxy, and even then you can only be attacked by your own proxy? Which rules out things like torsocks where you're running the proxy too.

Does this really merit all of last week's antics?

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#6

Post by junon » Wed, Oct 11, 2023, 6:05 AM UTC

cURL's own tracker had a banner stating severity High to be released October 11.

It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked.

EDIT: Why the downvotes? People don't like timezones or something?

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#7

Post by kramerger » Wed, Oct 11, 2023, 6:23 AM UTC

While this is a double screw up, I really like how the patch corrected the original issue but also removed this complex and unlikely path.

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#8

Post by kramerger » Wed, Oct 11, 2023, 6:24 AM UTC

KirillPanov wrote: post #5

Wat. So you can only be attacked if you're using a socks5 proxy, and even then you can only be attacked by your own proxy ? Which rules out things like torsocks where you're running the proxy too. Does this really merit all of last week's antics?

There are tons of shady open or semi-open proxies out there.

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#9

Post by 1una » Wed, Oct 11, 2023, 6:24 AM UTC

junon wrote: post #6

cURL's own tracker had a banner stating severity High to be released October 11. It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked. EDIT: Why the downvotes? People don't like timezones or something?

The patch was supposed to be published around 06:00 UTC on October 11. The commit is 13 hours early.

Re: Curl/libcurl HIGH CVE-2023-38545 leaked early?

#10

Post by junon » Wed, Oct 11, 2023, 6:32 AM UTC

1una wrote: post #9

junon wrote: post #6

cURL's own tracker had a banner stating severity High to be released October 11. It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked. EDIT: Why the downvotes? People don't like timezones or something?

The patch was supposed to be published around 06:00 UTC on October 11. The commit is 13 hours early.

Perhaps, but to be honest trying to coordinate times on a specific disclosure day is futile. I would imagine Daniel is aware of this phenomenon.