libcurl is awesome. The fact it’s over 20 years old, is used by a gazillion projects and runs on two planets is proof of its quality.

Today I learned that GTA5 credits curl.

https://daniel.haxx.se/blog/2018/09/17/the-worlds-biggest-curl-installations/

I’m still not sure whether there’s a big vulnerability announcement coming up or if this is just one giant shitpost regarding the latest 9.8 CVE

With all Curl versions of the past few years being impacted…

oooof. Now I agree it is the worst. At first I really thought it was just something introduced in the past update… or the past major update.

This is the best summary I could come up with:

The widely-used Curl project as a command-line tool and library for transferring data via a variety of protocols is preparing to roll-out Curl 8.4 early in order to address a particularly nasty vulnerability.

Details on this new Curl library vulnerability are light as it’s still embargoed until Wednesday, 11 October.

However, this notice by Curl lead developer Daniel Stenberg sheds some light on it being particularly hard-hitting: "We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW.

The one rated HIGH is probably the worst curl security flaw in a long time…CVE-2023-38545: severity HIGH (affects both libcurl and the curl tool)…I cannot disclose any information about which version range that is affected, as that would help identify the problem (area) with a very high accuracy so I cannot do that ahead of time.

The brief disclosure was posted a few days ago to prepare for the Curl 8.4 release happening on 11 October.

With all Curl versions of the past few years being impacted and Stenberg himself calling it “probably the worst curl security flaw in a long time”, it sounds like it will be a particularly hard-hitting vulnerability in the libcurl library and command-line tool.

The original article contains 225 words, the summary contains 212 words. Saved 6%. I’m a bot and I’m open source!

Funny enough, I was just listening to an episode of a podcast that had the inventor and maintainer of Curl on, and they described the methods for bug solving and feature requests.

He said while he largely doesn’t do most of the work, he still reads over code and denies random new internet protocols until it matures, and often by the time they worked have added it in a release the fad is gone.

I forget what they said about bugs, but I do know he said “I have good people who have written more code for my program than myself, and when they find bugs or get issues, i trust them over random github accounts.”

I don’t think this will last long from curl directly, the issue is devices that don’t or can’t be upgraded.