The Challenge of Patching Curl
-
curl 8.4.0
We cut the release cycle short and decided to ship this release now rather than later because of the heap overflow issue we found.
-
How I made a heap overflow in curl
In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH.
While the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened.
-
Critical SOCKS5 Vulnerability in cURL Puts Enterprise Systems at Risk
The bug, tracked as CVE-2023-38545, exists in the libcurl library that handles data exchange between devices and servers.
-
Long-awaited curl vulnerability flops
The release of two bugs had been highly anticipated in the security community, with the program’s lead developer, Daniel Stenberg, describing the bug as “the worst curl security flaw in a long time.”
But security researchers expecting the next Log4Shell — an easily exploitable vulnerability with a huge install base — were disappointed that the bug is only exploitable in rare circumstances.
-
curl vulnerabilities ironed out with patches after week-long tease
Described by curl project founder and lead developer Daniel Stenberg as "probably the worst curl security flaw in a long time," the patches address two separate vulnerabilities: CVE-2023-38545 and CVE-2023-38546.