Curl Preps For "Probably The Worst Curl Security Flaw In A Long Time"

[phoronix]

Phoronix: Curl Preps For "Probably The Worst Curl Security Flaw In A Long Time"

The widely-used Curl project as a command-line tool and library for transferring data via a variety of protocols is preparing to roll-out Curl 8.4 early in order to address a particularly nasty vulnerability...

https://www.phoronix.com/news/Curl-8.4-Coming

[Danny3]

Cool that Most Linux distros / package managers use the dependency system and once the library is updated all programs that use it are good.

Not sure I can say the same thing about programs distributed in the Flatpak or Snap format.
I assume that there if the program's developer / maintainer doesn't update its program with the new version of the dependency, you are stuck with the old insecure one.

[rene]

At least they handle it way more professional than FSF's GNU Glibc, ... https://www.youtube.com/watch?v=QovmkJzr7vU

[Vorpal]

Cool that Most Linux distros / package managers use the dependency system and once the library is updated all programs that use it are good.

Not sure I can say the same thing about programs distributed in the Flatpak or Snap format.
I assume that there if the program's developer / maintainer doesn't update its program with the new version of the dependency, you are stuck with the old insecure one.

Both flatpak and snap have various concepts of platforms that the application packages build upon. That absolutely doesn't cover everything, but it does at least provide a baseline. I haven't looked if libcurl are in the respective platforms or not. Either way wouldn't be unreasonable.

[RealNC]

Worst-case scenario is "curl https://whatever.wat" ending up executing arbitrary code on your machine?

[juxuanu]

Rewrite it in Rust.

[EphemeralEft]

Rewrite it in Rust.

There it is. We can all go home, folks.

[cen1]

Worst-case scenario is "curl https://whatever.wat" ending up executing arbitrary code on your machine?

That is what I'd imagine... so it can't be that bad for general population outside of some niche use cases. I think libcurl surface would be greater if you have any kind of backend that goes and fetches user provided addresses.

[NotMine999]

Rewrite it in Rust.

Oh please. Just stop it. The retort of "Rewrite it in Rust" is getting older faster than all of my old girlfriends.

[juxuanu]

Oh please. Just stop it. The retort of "Rewrite it in Rust" is getting older faster than all of my old girlfriends.

Yes. please, in Rust.