5 ms·

Increased CVE Activity in Curl?

70 points by TangerineDream 4y ago

belter 4y ago
Did the author of cURL ever get his US Visitor Visa, or is he still considered too dangerous to allow into the USA? \s
- bagder 4y ago
  The author (me) did get a visa, after a mere 937 days: https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days/ https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days...
  - rwmj 4y ago
    Roughly the same thing happened to me, although it only took 11 months to get the visa. It happened to so many people at the company I work for (IBM / Red Hat) that they eventually gathered together testimonials from everyone and sent them to one of the senators where Red Hat is based in North Carolina, and magically everyone's visa "problem" was resolved within 2 weeks. The root cause is that Trump defunded the relevant sections of the State Department: https://www.economist.com/united-states/2022/07/28/americas-legal-immigration-system-remains-gummed-up https://www.economist.com/united-states/2022/07/28/americas-...
  - ghoward 4y ago
    Do you have your process of how to handle bug reports written down? I'd love to see it, especially if it includes what data you gather, like the commit that introduced a bug. I guess it's probably in everything curl or will be?
    - bagder 4y ago
      I only record the introduction commit for security flaws as they are rare and important enough to give that level of attention. And that's not a mandatory or required step in our process, I do it mostly as a service for users and to satisfy my own curiosity. Our process for handling security problems in curl is documented here: https://curl.se/dev/secprocess.html https://curl.se/dev/secprocess.html
  - westmeal 4y ago
    Love you man great software
- deleted 4y ago
  [deleted]
MarcoZavala 4y ago
pcthrowaway 4y ago
I'm looking at these CVEs thinking "How could curl have a CVE", and to be fair, some of these do seem theoretically significant if combined with other software bugs. But some of these just look like regular bugs. For example, https://curl.se/docs/CVE-2022-27778.html https://curl.se/docs/CVE-2022-27778.html curl might remove the wrong file when --no-clobber is used together with --remove-on-error. The --remove-on-error option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The --no-clobber option prevents curl from overwriting a file if it already exists, and instead appends a number to the name to create a new unused file name. If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original file name without the added number. Which seems like at worst it deletes a previous version of a file fetched with curl, and leaves a partial file, rather than deleting the partial file. I understand there's perhaps a very unlikely scenario in which this could lead to a system being compromised, but it depends on too many other factors that are also increasingly unlikely, it seems on the order of likelihood of reversing SHA-256
- stefan_ 4y ago
  It's a C library that includes support for all kind of arcane and useless protocols and operates on a string-based programming model with a lot of magic. It is a prime fucking target for all kinds of CVEs.
- hsbauauvhabzb 4y ago
  Integrity and availability are security too. I would call arbitrary file delete a security issue even if it could only be triggered by a non malicious actor.
jicea 4y ago
I'm one of the maintainer of an Open Source project [1] that strongly relies upon libcurl. I'm really grateful to Daniel and all the contributors for all the work in curl/libcurl, this is one of our common software gem that is used by many (even in space [2]), so thanks a lot! [1]: https://github.com/Orange-OpenSource/hurl https://github.com/Orange-OpenSource/hurl [2]: https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/ https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/

belter 4y ago

Did the author of cURL ever get his US Visitor Visa, or is he still considered too dangerous to allow into the USA? \s

bagder 4y ago
The author (me) did get a visa, after a mere 937 days: https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days/ https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days...
- rwmj 4y ago
  Roughly the same thing happened to me, although it only took 11 months to get the visa. It happened to so many people at the company I work for (IBM / Red Hat) that they eventually gathered together testimonials from everyone and sent them to one of the senators where Red Hat is based in North Carolina, and magically everyone's visa "problem" was resolved within 2 weeks. The root cause is that Trump defunded the relevant sections of the State Department: https://www.economist.com/united-states/2022/07/28/americas-legal-immigration-system-remains-gummed-up https://www.economist.com/united-states/2022/07/28/americas-...
- ghoward 4y ago
  Do you have your process of how to handle bug reports written down? I'd love to see it, especially if it includes what data you gather, like the commit that introduced a bug. I guess it's probably in everything curl or will be?
  - bagder 4y ago
    I only record the introduction commit for security flaws as they are rare and important enough to give that level of attention. And that's not a mandatory or required step in our process, I do it mostly as a service for users and to satisfy my own curiosity. Our process for handling security problems in curl is documented here: https://curl.se/dev/secprocess.html https://curl.se/dev/secprocess.html
- westmeal 4y ago
  Love you man great software
deleted 4y ago
[deleted]

MarcoZavala 4y ago

pcthrowaway 4y ago

I'm looking at these CVEs thinking "How could curl have a CVE", and to be fair, some of these do seem theoretically significant if combined with other software bugs. But some of these just look like regular bugs. For example, https://curl.se/docs/CVE-2022-27778.html https://curl.se/docs/CVE-2022-27778.html curl might remove the wrong file when --no-clobber is used together with --remove-on-error. The --remove-on-error option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The --no-clobber option prevents curl from overwriting a file if it already exists, and instead appends a number to the name to create a new unused file name. If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original file name without the added number. Which seems like at worst it deletes a previous version of a file fetched with curl, and leaves a partial file, rather than deleting the partial file. I understand there's perhaps a very unlikely scenario in which this could lead to a system being compromised, but it depends on too many other factors that are also increasingly unlikely, it seems on the order of likelihood of reversing SHA-256

stefan_ 4y ago
It's a C library that includes support for all kind of arcane and useless protocols and operates on a string-based programming model with a lot of magic. It is a prime fucking target for all kinds of CVEs.
hsbauauvhabzb 4y ago
Integrity and availability are security too. I would call arbitrary file delete a security issue even if it could only be triggered by a non malicious actor.

jicea 4y ago

I'm one of the maintainer of an Open Source project [1] that strongly relies upon libcurl. I'm really grateful to Daniel and all the contributors for all the work in curl/libcurl, this is one of our common software gem that is used by many (even in space [2]), so thanks a lot! [1]: https://github.com/Orange-OpenSource/hurl https://github.com/Orange-OpenSource/hurl [2]: https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/ https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/