Oct 12, 2023 at 12:42 PM cURL version 8.4.0 released with two high-risk security patches and IPFS URL support
cURL, the URL syntax-based data transfer command-line tool, has released its version 8.4.0, featuring two high-risk security patches. The patches, addressing vulnerabilities CVE-2023-38545 and CVE-2023-38546, were characterized by cURL project founder and lead developer Daniel Stenberg as “probably the worst curl security flaw in a long time”.
CVE-2023-38545 pertains to a flaw causing cURL to overflow a heap-based buffer in the SOCKS5 proxy handshake, while CVE-2023-38546 allows an attacker to insert cookies into a running program using libcurl under a specific set of conditions. The latter requires the cookies to be placed in a file named “none” in the application’s current directory.
In addition to the security patches, version 8.4.0 also supports InterPlanetary File System (IPFS) URLs via gateway, and includes various other enhancements and bug fixes.
- HTTP Client
- Free • Open Source
External links
- curl 8.4.0Daniel Stenberg • Official source
- Curl: [RELEASE] curl 8.4.0Curl • Official source
- Curl 8.4 Released For Addressing A Big Security VulnerabilityPhoronix
- Vulnerabilities in curl patched after week-long teaseThe Register
- Two High-Risk Security Flaws Discovered in Curl Library - New Patches ReleasedThe Hacker News