In association with the release of curl 8.4.0, we publish a security advisory and all the details for CVE-2023-38545. This problem is the worst security problem found in curl in a long time. We set it to severity HIGH.

While the advisory contains all the necessary details. I figured I would use a few additional words and expand the explanations for anyone who cares to understand how this flaw works and how it happened.

you are viewing a single comment's thread
view the rest of the comments

[–] onlinepersona@programming.dev 8 points 2 years ago (2 children)

He brings up the "just rewrite in rust" argument. Curious as I am, I had a look and only found a single project that actually tried it https://github.com/TogarashiPepper/curl

It didn't get very far.

[–] the_ocs@lemmy.world 6 points 2 years ago

The argument for rust is memory safety, which allows you to avoid these very common, often serious, issues.

It's an argument that goes far beyond curl, and some random curl clone written in rust.

load more comments (1 replies)