Nasty bug discovered in widely used Linux utility curl, and patches already rolled out

For the most part, ordinary Linux users don't know what curl is. Programmers and system administrators know the utility well, though. This shell command and its associated library, libcurl, is used to transfer data over every network protocol you've ever heard of, and it's used in desktops, servers, clouds, cars, television sets, routers, and pretty much every Internet of Things (IoT) device. Curl's developers estimate it's used in over twenty billion instances. And now there's a potentially nasty security bug in it, CVE-2023-38545. Also: Google Cloud, AWS, and Cloudflare report largest DDoS attacks ever How nasty? Curl's lead developer, Daniel Stenberg, wrote in a blog post that it's "the worst security problem found in curl in a long time." He should know. Security experts agree. This is, in a word, bad. As Saeed Abbasi, Qualys Threat Research Unit Product Manager, warned: Organizations must act swiftly to inventory, scan, and update all systems utilizing curl and libcurl. In particular, the gravity of the high-severity vulnerability mandates immediate and cautious attention to safeguarding interconnected and web-aware applications, ensuring the rich data transfer functionality curl and libcurl provide remain unimpaired and secure. Specifically, the security hole can be invoked when someone is using the SOCKS5 proxy protocol. This rather simple protocol sets up network communication via a dedicated "middleman." The protocol is used when communicating over Tor, the open-sour...