Please bump curl-sys to 7.84 (or 7.85) #457

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Closed

klensy opened this issue Aug 31, 2022 · 2 comments · Fixed by #459

klensy commented Aug 31, 2022

Curl 7.84 was released June 27 2022, and there was some CVE fix (https://curl.se/docs/vuln-7.84.0.html), so it's good time to update?

Owner

alexcrichton commented Aug 31, 2022

Would you be up for sending a PR to do this?

sagebind mentioned this issue

Update bundled curl to 7.85.0 #459

Merged

sagebind closed this as completed in #459

sagebind added a commit that referenced this issue


          Update bundled curl to 7.85.0 (#459)

c36cfcc

This version contains patches for five new CVEs:

- [CVE-2022-32205: Set-Cookie denial of service](https://curl.se/docs/CVE-2022-32205.html)
- [CVE-2022-32206: HTTP compression denial of service](https://curl.se/docs/CVE-2022-32206.html)
- [CVE-2022-32207: Unpreserved file permissions](https://curl.se/docs/CVE-2022-32207.html)
- [CVE-2022-32208: FTP-KRB bad message verification](https://curl.se/docs/CVE-2022-32208.html)
- [CVE-2022-35252: control code in cookie denial of service](https://curl.se/docs/CVE-2022-35252.html)

Fixes #457.

Author

klensy commented Sep 7, 2022

Thanks for release.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment