Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

upgrade libcurl for security vulnerabilities. #2357

Closed
lalitb opened this issue Oct 11, 2023 · 0 comments · Fixed by #2358
Closed

upgrade libcurl for security vulnerabilities. #2357

lalitb opened this issue Oct 11, 2023 · 0 comments · Fixed by #2358
Assignees
Labels
bug Something isn't working CVE Common Vulnerabilities and Exposures security

Comments

@lalitb
Copy link
Member

lalitb commented Oct 11, 2023

Upgrade bazel build to use the latest libcurl version v8.4.0 (to be released on Oct 11, 2023) for below two security vulnerabilities:

CVE-2023-38545, a high severity flaw that affects both the libcurl library and the curl tool, and
CVE-2023-38546, a low severity bug that only affects libcurl.

Release announcement: curl/curl#12026

Changes required:
bazel: upgrade version here -

"https://curl.haxx.se/download/curl-7.73.0.tar.gz",

For CMake, we don't use sticky version for libcurl, and rely on package manager (apt-get, vcpkg) so hopefully no changes be required.

Thanks @ThomsonTan for bringing this up. Please add if I missed something.

@lalitb lalitb added bug Something isn't working security labels Oct 11, 2023
@github-actions github-actions bot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Oct 11, 2023
@esigo esigo removed the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Oct 11, 2023
marcalff added a commit to marcalff/opentelemetry-cpp that referenced this issue Oct 11, 2023
@marcalff marcalff added the CVE Common Vulnerabilities and Exposures label Oct 11, 2023
@marcalff marcalff self-assigned this Oct 11, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working CVE Common Vulnerabilities and Exposures security
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants