Conversation

Notices

1. Disinformation Purveyor :verified_think: (thatguyoverthere@shitposter.club)'s status on Monday, 11-Sep-2023 22:41:59 JST Disinformation Purveyor :verified_think:
   @Suiseiseki I guess technically. I can see an argument in this case for denial of service, but it's hardly 9.8 out of 10 on risk. The bug was fixed nearly 4 years before the cve was published, but even if someone is still running the vulnerable version it's not like that means they are going to use retries with a large number capable of overflow. A malicious user would likely use smaller increments for retry anyway. It isn't like curl has some kind of web interface that makes it available to unauthorized users.
   • Disinformation Purveyor :verified_think: (thatguyoverthere@shitposter.club)'s status on Monday, 11-Sep-2023 22:45:10 JST Disinformation Purveyor :verified_think:

     in reply to
     @Suiseiseki I agree though that bugs are often the source of vulnerabilities and should be fixed when discovered. I just think the cve system has become a box checking endeavor that often distracts from real security improvements.
   • m0xEE (m0xee@social.librem.one)'s status on Tuesday, 12-Sep-2023 00:10:25 JST m0xEE

     in reply to

     @thatguyoverthere @Suiseiseki If some public service like a port checker uses curl in its scripts and one is allowed to set retry count, this can be theoretically be used for DoS attacks, but I still fail to see this as high severity — it should be something that allows privilege escalation or remote code execution, this isn't it even remotely 🤷

     Disinformation Purveyor :verified_think: likes this.
   • Disinformation Purveyor :verified_think: (thatguyoverthere@shitposter.club)'s status on Tuesday, 12-Sep-2023 00:10:54 JST Disinformation Purveyor :verified_think:

     in reply to

     • m0xEE
     @m0xee @Suiseiseki yeah when everything is high severity nothing is.