The maintainers of the cURL data transfer project are working on patching two vulnerabilities in the software, including a high-severity bug impacting both libcurl and curl.
cURL provides both a library (libcurl) and command-line tool (curl) for transferring data with URL syntax, supporting various network protocols, including SSL, TLS, HTTP, FTP, SMTP, and more.
The two issues are tracked as CVE-2023-38545 and CVE-2023-38546, and the maintainers are warning that the former has a ‘high severity’ rating and could be considered one of the most severe flaws in the open source tool.
“We are cutting the release cycle short and will release curl 8.4.0 on October 11, including fixes for a severity HIGH CVE and one severity LOW. The one rated HIGH is probably the worst curl security flaw in a long time,” the maintainers note in an advisory.
Details on the vulnerability itself and on the affected curl versions have yet to be disclosed, but the maintainers say that all iterations released over the “last several years” are vulnerable.
The advisory was published ahead of patches to warn organizations of the bug’s severity, so that they can prepare for the upcoming updates. Member distributions were also notified, so they can prepare patches.
“No one else gets details about these problems before October 11 without a support contract and a good reason,” curl’s maintainers say.
“Organizations should urgently inventory and scan all systems utilizing curl and libcurl, anticipating identifying potentially vulnerable versions once details are disclosed with the release of Curl 8.4.0 on October 11. Immediate update implementation upon release is essential to safeguard systems against these pressing vulnerabilities,” Qualys product manager Saeed Abbasi points out.
According to curl’s maintainers, the vulnerability potentially impacts all projects relying on libcurl, although some software may use it in a way that does not allow exploitation.
“Updating the shared libcurl library should be enough to fix this issue on all operating systems,” the maintainers point out.
Related: Google Proposes More Transparent Vulnerability Management Practices
Related: Information Disclosure, DoS Flaws Patched in libcurl
Related: cURL Security Audit Reveals Several Vulnerabilities
