3 ms·

To anyone that knows what the vulnerability is, this announcement does not bring any new information.

• rowanG077 3y ago
  It most definitely does. You know it's going to be patched. You no longer have to tiptoe around to conceal the problem. This can be the difference between snooping a bit of data here and there and just straight up dumping the contents of entire servers. Of course this depends on the vulnerability itself. But knowing a vulnerability will be patched can be hugely interesting and worthwhile information
  • tsimionescu 3y ago
    Except of course they don't know what vulnerability is getting patched. So, they might actually end up revealing a different vulnerability.
    • rowanG077 3y ago
      Of course. It's a risk that could easily be worth it depending on the actor and vulnerability
• tsimionescu 3y ago
  I suppose it's theoretically possible someone was hoarding this as a zero-day and may decide to more actively exploit it before it gets patched. Except of course that they don't know which precise vulnerability it is.
  • Ekaros 3y ago
    Also what I consider is that who has insider access and how does that information leak... This fix must be known at least some members of curl developers. Will they leak it or not? Or anyone who receive it early...