Windows 10: Updating Microsoft Curl to the most recent version. Curl 7.84 <= 8.2.1 Header DoS...

Hi,I have several servers that have this version of Curl installed. I want to get my servers updated to the most recent version so my questions are:1. What is the best way to get these servers up to the most current version? It seems we are lacking 11 updates since then.2. Could the auto updater failed at one point resulting in these servers not obtaining the proper version?My end goal is to get curl updated to the most current version but I am a little confused on what route to take since we are severely lacking updates. I need this done to resolve a vulnerability found in my environment. Ve

:)

 

Curl Update for Win 11

Hi,

The Curl Executable in C:\Windows\System32 (CURL.EXE) is version 7.83.1 which is lower than 7.87.0 and is affeacted by a use-after-free vulnerability.

Curl can be asked to tunnel virtually all protocols it supports through an HTTP proxy. HTTP proxies can (and often do) deny such tunnel operations.

When getting denied to tunnel the specific protocols SMB or TELNET, curl would use a heap-allocated struct after it had been freed, in its transfer shutdown code path.

Referrence:

curl - HTTP Proxy deny use after free - CVE-2022-43552

When to expect an offical update from Windows as their is a latest version available on curl for Windows...

Regards

 

Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001) with windows 10 and windows 11

Hi,

Nessus found a vulnerability with curl. It looks like Windows 10 and Windows 11 use version 8.0.1 which is vulnerable. (Curl Arbitrary File Write 7.x >= 7.84.0 / 8.x <= 8.1.2 (CVE-2023-32001))

Does Microsoft plan to release a patch?

curl - fopen race condition - CVE-2023-32001

 

Update on Patch for Curl

Yes. As a developer I can tell you that there are live updates for curl on www.github.com most likely under the Microsoft repository.