3 ms·

TIL Microsoft ships curl.

• dspillett 3y ago
  It is saying that the version being shipped is from 2023-Mar-20 and that there are vulnerabilities that have since been patched, which would allow a malicious server to DoS your client¹, cause a buffer overflow², or inject cookies³. Though in fairness to MS two of those issues were only addressed in the latest version, released a week ago, despite them being raised in October last year some months before the release MS are currently using, and the other was addressed in the previous release about a month ago. I suspect a great many other places are sill not up-to-date on those given how many products bundle or otherwise depend upon libcurl (a quick check shows Debian have backported the updates into the version they have in the stable release, so at least some significant players are certainly doing better). Also, there isn't evidence of any checking to see if MS are releasing stock cur/libcurl or if they have back-ported subsequent fixes like Debian do. Before a post with the sensational headline “shipping rotten software to billions of unsuspecting customers” I'd like to think that such cursory checks would be done and information about the results included in the post (especially if they came back in a way that looks negative for MS!). -- [1] CVE-2023-38039 - sev=medium [2] CVE-2023-38545 - sev=high - without more digging I can't tell from that if this would just make curl or an application using libcurl fall over, or if there is worse potential like RCE [3] CVE-2023-38546 - sev=low