Download
Browse source Changelog tiny-curl
Documentation
Project   Bug Bounty FAQ   Help us   Known bugs   TODO Protocols   CA bundle   HTTP Cookies   HTTP/2   SSL Certs Releases   Security   Version numbers   Vulnerabilities curl tool   man page   Tutorial   HTTP scripting Videos Who and Why
libcurl
ABI API Competitors Examples Features Mailing list Related libs Using libcurl Tutorial Testimonials
Get Help
curl-library curl-users IRC / chat Mailing lists Everything curl [book] Video presentations Report a bug Paid support
Development
Autobuilds Code review Code style Contribute Dashboard Deprecate Internals Release Notes Release Procedure Roadmap Run Tests Specifications Test curl Tests Overview Vulnerability Disclosure Policy
News
Changelog Release table
curl / Mailing Lists / curl-users / Single Mail
Buy commercial curl support from WolfSSL. We help you work out your issues, debug your libcurl applications, use the API, port to new platforms, add new features and more. With a team lead by the curl founder himself.

curl in Windows found vulnerable by scanners

From: Daniel Stenberg via curl-users <curl-users_at_lists.haxx.se>
Date: Wed, 1 Nov 2023 23:30:33 +0100 (CET)

Hello

People keep emailing me about their security scanners finding that the curl
tool version shipped in Windows contains several CVEs. (It still ships curl
8.0.1)

I'm afraid that all parts of Windows, including the bundled curl tool, is
managed by and shipped by Microsoft. Only they can upgrade Windows - and in
this aspect curl is to be counted as a part of that.

This email is posted here as an attempt to reach more people with this
information. 

-- 
  / daniel.haxx.se
  | Commercial curl support up to 24x7 is available!
  | Private help, bug fixes, support, ports, new features
  | https://curl.se/support.html
-- 
Unsubscribe: https://lists.haxx.se/mailman/listinfo/curl-users
Etiquette:   https://curl.se/mail/etiquette.html
Received on 2023-11-01