The latest release of curl, a utility and library for data transfer over the network, has occurred. Over its 25 years of development, curl has implemented support for numerous network protocols, such as HTTP, Gopher, FTP, SMTP, IMAP, POP3, SMB, and MQTT. The libcurl library is used by significant community projects such as Git and LibreOffice. The project code is distributed under the Curl (MIT license variant).
This release is noteworthy for two main reasons:
- has added support for the protocol IPFS;
- fixed a critical vulnerability vulnerability in the SOCKS5 protocol implementation;
The vulnerability was particularly highlighted by the project author, Daniel Stenberg, as "one of the most serious vulnerabilities in curl for quite some time." The vulnerability arises from a logic error in the connection setup with the SOCKS5 proxy, allowing an attacker to overflow the buffer and execute arbitrary code on the application side.
The flaw was discovered by Jay Satiro, as part of the The Internet Bug Bounty who was awarded $4,660.
It’s worth noting that Daniel takes an active stance on security and working is working on implementing an HTTP protocol implementation in curl using Rust.
Source: linux.org.ru
