Curl Preps For "Probably The Worst Curl Security Flaw In A Long Time"

The widely-used Curl project as a command-line tool and library for transferring data via a variety of protocols is preparing to roll-out Curl 8.4 early in order to address a particularly nasty vulnerability.

Details on this new Curl library vulnerability are light as it's still embargoed until Wednesday, 11 October. However, this notice by Curl lead developer Daniel Stenberg sheds some light on it being particularly hard-hitting:

"We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl security flaw in a long time...CVE-2023-38545: severity HIGH (affects both libcurl and the curl tool)...I cannot disclose any information about which version range that is affected, as that would help identify the problem (area) with a very high accuracy so I cannot do that ahead of time. The "last several years" of versions is as specific as I can get."

The brief disclosure was posted a few days ago to prepare for the Curl 8.4 release happening on 11 October.

With all Curl versions of the past few years being impacted and Stenberg himself calling it "probably the worst curl security flaw in a long time", it sounds like it will be a particularly hard-hitting vulnerability in the libcurl library and command-line tool.