Increased CVE Activity in Curl?(daniel.haxx.se)

70 pointsby TangerineDream4 anni fa10 comments

daniel.haxx.se

https://daniel.haxx.se/blog/2022/08/22/increased-cve-activity-in-curl/

4 comments

jicea4 anni fa

I'm one of the maintainer of an Open Source project [1] that strongly relies upon libcurl. I'm really grateful to Daniel and all the contributors for all the work in curl/libcurl, this is one of our common software gem that is used by many (even in space [2]), so thanks a lot!

[1]: https://github.com/Orange-OpenSource/hurl

[2]: https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/

pcthrowaway4 anni fa

I'm looking at these CVEs thinking "How could curl have a CVE", and to be fair, some of these do seem theoretically significant if combined with other software bugs.

But some of these just look like regular bugs. For example, https://curl.se/docs/CVE-2022-27778.html

    curl might remove the wrong file when --no-clobber is used together with --remove-on-error.
    The --remove-on-error option tells curl to remove the output file when it returns an error, and not leave a partial file behind. The --no-clobber option prevents curl from overwriting a file if it already exists, and instead appends a number to the name to create a new unused file name.
    If curl adds a number to not "clobber" the output and an error occurs during transfer, the remove on error logic would remove the original file name without the added number.

Which seems like at worst it deletes a previous version of a file fetched with curl, and leaves a partial file, rather than deleting the partial file. I understand there's perhaps a very unlikely scenario in which this could lead to a system being compromised, but it depends on too many other factors that are also increasingly unlikely, it seems on the order of likelihood of reversing SHA-256

hsbauauvhabzb4 anni fa

Integrity and availability are security too. I would call arbitrary file delete a security issue even if it could only be triggered by a non malicious actor.

stefan_4 anni fa

It's a C library that includes support for all kind of arcane and useless protocols and operates on a string-based programming model with a lot of magic. It is a prime fucking target for all kinds of CVEs.

belter4 anni fa

Did the author of cURL ever get his US Visitor Visa, or is he still considered too dangerous to allow into the USA? \s

bagder4 anni fa

The author (me) did get a visa, after a mere 937 days: https://daniel.haxx.se/blog/2020/11/09/a-us-visa-in-937-days...

rwmj4 anni fa

Roughly the same thing happened to me, although it only took 11 months to get the visa. It happened to so many people at the company I work for (IBM / Red Hat) that they eventually gathered together testimonials from everyone and sent them to one of the senators where Red Hat is based in North Carolina, and magically everyone's visa "problem" was resolved within 2 weeks. The root cause is that Trump defunded the relevant sections of the State Department: https://www.economist.com/united-states/2022/07/28/americas-...

ghoward4 anni fa

Do you have your process of how to handle bug reports written down? I'd love to see it, especially if it includes what data you gather, like the commit that introduced a bug.

I guess it's probably in everything curl or will be?

bagder4 anni fa

I only record the introduction commit for security flaws as they are rare and important enough to give that level of attention. And that's not a mandatory or required step in our process, I do it mostly as a service for users and to satisfy my own curiosity.

Our process for handling security problems in curl is documented here: https://curl.se/dev/secprocess.html

westmeal4 anni fa

Love you man great software

[deleted]4 anni fa

MarcoZavala4 anni fa