Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11 · curl/curl · Discussion #12026
github.com
We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl securit...
  • nathris@lemmy.ca
    12·
    2 years ago

    Could be an RCE exploit. Doesn’t matter if it’s privilege escalation at that point because it can be used to execute a payload that can.

    • taaz@biglemmowski.winOPEnglish
      2·
      2 years ago

      To top it of it seems it’s also contained in libcurl, and getting RCEd just by doing a request does not sound fun.

    • PowerCrazy@lemmy.ml
      14·
      2 years ago

      I’ll admit i’m out of my depth about exactly how curl works on the local system, but surely if there is a vulnerability in the “libcurl” library that is much more serious and severe then just saying “curl” is vulnerable.

      I’m assuming that libcurl touches a huge amount of the linux network stack.