The data transfer utility curl has turned 25 years old. To celebrate this milestone, a new major version branch, cURL 8.0, has been released. The first release of the previous branch, curl 7.x, was created in 2000, and since then, the codebase has expanded from 17,000 to 155,000 lines of code, the number of command-line options has grown to 249, and support has been implemented for 28 network protocols, 13 cryptographic libraries, 3 SSH libraries, and 3 HTTP/3 libraries. The project's code is distributed under the Curl license (a variant of the MIT license).
For HTTP/HTTPS, the utility provides the ability to flexibly form network requests, specifying parameters such as Cookie, user_agent, referer, and any other headers. In addition to HTTPS, HTTP/1.x, HTTP/2.0, and HTTP/3, the utility supports sending requests using SMTP, IMAP, POP3, SSH, Telnet, FTP, SFTP, SMB, LDAP, RTSP, RTMP, and other network protocols. At the same time, the libcurl library is being developed, providing an API for utilizing all of curl's functions in programs written in languages such as C, Perl, PHP, and Python.
The new release cURL 8.0 does not contain any radical innovations or breaking changes to the API and ABI. The change in version number is due to the desire to mark the project's 25th anniversary and finally drop the second digit of the version that has been accumulating for over 22 years.
In the new version, 6 vulnerabilities in the handlers for the TELNET, FTP, SFTP, GSS, SSH, and HSTS protocols have been fixed, of which 5 are marked as minor, and one has a moderate level of severity (CVE-2023-27535, the possibility of reusing a previously created FTP connection with different parameters, including when the user's credentials do not match). Among changes not related to vulnerability and bug fixes, only the discontinuation of support for building on systems that lack functional 64-bit data types is noted (building now requires having the 'long long' type).
Shortly after the release of 8.0.0, version 8.0.1 was released with a hotfix for a bug that led to crashes in some testing scenarios.
Source: opennet.ru
