Curl/libcurl HIGH CVE-2023-38545 leaked early?

[junon]

cURL's own tracker had a banner stating severity High to be released October 11.

It's October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked.

EDIT: Why the downvotes? People don't like timezones or something?

[qwertox]

> The new version and details about the two CVEs will be published around 06:00 UTC on the release day.

https://github.com/curl/curl/discussions/12026 (2023-10-04T06:17:44Z)

[1una]

The patch was supposed to be published around 06:00 UTC on October 11. The commit is 13 hours early.

[jo-m]

The CVE page on curl.se is also online as of now: https://curl.se/docs/CVE-2023-38545.html

[royce]

"[PATCH] socks: return error if hostname too long for remote resolve

Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that did not work as intended and caused a security issue."

[andersa]

Will people stop messing with unsafe buffers in C already? Even just using C++ with the most basic buffer/dynamic array template would have prevented this issue.

[hyperman1]

While I agree with the general thrust of your comment, note that a) this is specifically adressed in Daniel's blog post b) He stated the reason why it's not happening right now multiple times already, and they seem well thought out. (Basically, the code base is huge and not easily converted, and there is no compiler support for some of the platforms libcurl supports).

Engineering is based on trade offs. In this specific case, the answer is no, unfortunately. This does of course not absolve new or smaller projects of this critique, but let's give curl a pass on this one.

[kramerger]

While this is a double screw up, I really like how the patch corrected the original issue but also removed this complex and unlikely path.

[badrabbit]

The drama and suspense around this has been crazy lol. It's pretty bad but they hyped it up like it was the next log4j.

[junon]

See also https://news.ycombinator.com/item?id=37841496

[KirillPanov]

Wat.

So you can only be attacked if you're using a socks5 proxy, and even then you can only be attacked by your own proxy? Which rules out things like torsocks where you're running the proxy too.

Does this really merit all of last week's antics?

[CGamesPlay]

I don't totally think so? A malicious HTTPS server can redirect you to a fake URL with shell code in it. So it's applicable to everyone using SOCKSv5 proxies, and the attacker is not "your own proxy".

[Maxious]

You need to have a proxy running and configured to get to this codepath but the actual payload comes from a malicious URL/https server https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-ove...

[kramerger]

There are tons of shady open or semi-open proxies out there.