Curl Preps For "Probably The Worst Curl Security Flaw In A Long Time"

[cjcox]

There it is. We can all go home, folks.

Rewrite it in php. Sure, it will be a security hell scape, but odds of you being able to run it are slim as nothing will run unless using the version from yesterday, I mean, today, I mean from two minutes ago.

[S.Pam]

Cool that Most Linux distros / package managers use the dependency system and once the library is updated all programs that use it are good.

Not sure I can say the same thing about programs distributed in the Flatpak or Snap format.
I assume that there if the program's developer / maintainer doesn't update its program with the new version of the dependency, you are stuck with the old insecure one.

Absolutely true. Same with docker and statically built programs (like many go apps) too.

Otoh, an OS that doesn't update or can't immediately is also vulnerable too like most androids more that a couple of years old.

[bug77]

Rewrite it in Rust.

I know you were just yanking people's chains, but, sadly, curl isn't part of coreutils which already has a Rust counterpart. The approach for Rust seems to be to simply wrap libcurl: https://docs.rs/curl/latest/curl/

[timofonic]

What's the nature of these security flaws? Memory? Or what?

The article is not informative at all.

[peterdk]

What's the nature of these security flaws? Memory? Or what?

The article is not informative at all.

They are still working at releasing a update, so for now (as stated in the article) the information is limited to avoid immediate exploitation.

[timofonic]

They are still working at releasing a update, so for now (as stated in the article) the information is limited to avoid immediate exploitation.

Smart hackers are already making use of it, anyway...

Security by obscurity is retarded!

[V1tol]

I know you were just yanking people's chains, but, sadly, curl isn't part of coreutils which already has a Rust counterpart. The approach for Rust seems to be to simply wrap libcurl: https://docs.rs/curl/latest/curl/

That's simply a wrapper around C library. Any language has that.

What most of the people here don't know is that libcurl started looking into Rust quite a long time ago - https://daniel.haxx.se/blog/2020/10/...rl-with-hyper/

[F.Ultra]

Cool that Most Linux distros / package managers use the dependency system and once the library is updated all programs that use it are good.

Not sure I can say the same thing about programs distributed in the Flatpak or Snap format.
I assume that there if the program's developer / maintainer doesn't update its program with the new version of the dependency, you are stuck with the old insecure one.

Also every single Windows/macOS application that uses libcurl (in this example), which would be quite a lot, exhibits the exact same problem, and yet there are people complaining about how distros works and that we should more adopt the way Windows and macOS distributes software...

What's the nature of these security flaws? Memory? Or what?

The article is not informative at all.

That is all the information that Daniel have released even to us curl devs so he is keeping the info for this one quite close and only to a select internal group of selected devs.

[markg85]

I'm curlious what that vulnerability is. See what i did there? ^_^

I'm guessing it's a leak that either directly or indirectly allows code execution. Directly could for example be that data fetched through curl is also executed in some probably easy to trigger "facepalm" situation. Indirectly could be that there's a curl leak that isn't directly a security issue for curl itself but that other applications can abuse.

Just guesswork, could also be something different.

[Vistaus]

Oh please. Just stop it. The retort of "Rewrite it in Rust" is getting older faster than all of my old girlfriends.

Oh please. Just stop it. The retort of responding like this to a post that is obviously meant as a joke is getting older faster than all of my old girlfriends.