TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Curl/libcurl HIGH CVE-2023-38545 leaked early?

56 pointsby atyvrover 1 year ago

8 comments

junonover 1 year ago
cURL&#x27;s own tracker had a banner stating severity High to be released October 11.<p>It&#x27;s October 11 and was already October 11 for a lot of the world 13 hours ago (as of writing) when this patch was posted. Nothing was early, nothing was leaked.<p>EDIT: Why the downvotes? People don&#x27;t like timezones or something?
评论 #37841611 未加载
评论 #37841561 未加载
jo-mover 1 year ago
The CVE page on curl.se is also online as of now: <a href="https:&#x2F;&#x2F;curl.se&#x2F;docs&#x2F;CVE-2023-38545.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;curl.se&#x2F;docs&#x2F;CVE-2023-38545.html</a>
royceover 1 year ago
&quot;[PATCH] socks: return error if hostname too long for remote resolve<p>Prior to this change the state machine attempted to change the remote resolve to a local resolve if the hostname was longer than 255 characters. Unfortunately that did not work as intended and caused a security issue.&quot;
andersaover 1 year ago
Will people stop messing with unsafe buffers in C already? Even just using C++ with the most basic buffer&#x2F;dynamic array template would have prevented this issue.
评论 #37841800 未加载
kramergerover 1 year ago
While this is a double screw up, I really like how the patch corrected the original issue but also removed this complex and unlikely path.
badrabbitover 1 year ago
The drama and suspense around this has been crazy lol. It&#x27;s pretty bad but they hyped it up like it was the next log4j.
junonover 1 year ago
See also <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37841496">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=37841496</a>
KirillPanovover 1 year ago
Wat.<p>So you can only be attacked if you&#x27;re using a socks5 proxy, and even then you can only be attacked <i>by your own proxy</i>? Which rules out things like torsocks where you&#x27;re running the proxy too.<p>Does this really merit all of last week&#x27;s antics?
评论 #37841610 未加载
评论 #37841758 未加载
评论 #37841560 未加载