Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years.
Yes, found with AI.
@bagder@mastodon.social but curl is a client, not a server. How can it be attacked?
@bonkers@nerdculture.de welcome to the concept of "mr malicious server"
@bagder@mastodon.social so, the probability of a server being compromised, multiplied by probability of me curling that server is like one out of 1^64, so I guess I can sleep quietly :)
@bonkers@nerdculture.de right. But there are countless other services, apps and tools that you use or own, that use (lib)curl, and perhaps they could be doing it, which adds a tiny risk as well
@bagder@mastodon.social damn I need coffee. It was 2^64 :)