cURL developers take a second shot at fixing information disclosure flaw

guest · Jul 21, 2021

cURL developers take a second shot at fixing information disclosure flaw
‘We borked the fix,’ developer candidly admits
July 21, 2021
https://portswigger.net/daily-swig/...nd-shot-at-fixing-information-disclosure-flaw

Developers have taken a second stab at fixing a tricky flaw in cURL, the command-line tool and library for transferring data with URLs.

The utility, which is popular with developers, was subject to an information disclosure bug involving interactions with Telnet servers in June.
However, the attempted resolution of the flaw (CVE-2021-22898) failed to address an almost identical bug in the software which also presented an information disclosure, or potential data leak vulnerability in interacting with Telnet servers.
Click to expand...

20-year-old bug
This latest vulnerability (CVE-2021-22925) represents only a medium risk flaw, but its similarity to the previous bug prompted cURL developer Daniel Stenberg to declare it as the “most embarrassing security advisory for cURL for a long time”.

“We meant to fix this in the previous release but borked the fix so the problem remained and now we fix the same problem *again*,” Stenberg admitted in a recent Twitter update.

Both issues were introduced by coding changes made in March 2001, meaning the underlying flaw had laid dormant in the software for more than 20 years.
As explained in a technical advisory, [...]
Click to expand...

Log in or Sign up

cURL developers take a second shot at fixing information disclosure flaw

guest Guest

Log in or Sign up

cURL developers take a second shot at fixing information disclosure flaw

guest Guest

Useful Searches