Microsoft's October Win10 and Win11 updates did not fix curl vulnerabilities, which is as destructive as Log4j

Thanks to CTOnews.com netizen Alejandro86 for the clue delivery! CTOnews.com October 14 news, command line tool curl recently exposed two vulnerabilities, tracking numbers CVE-2023-38545 and CVE-2023-38546, the former vulnerability level is "critical," its destructive power is no less than Log4j.

CVE-2023-38545, a high-severity vulnerability affecting the libcurl library and curl tool;

CVE-2023-38546, a low severity vulnerability affecting only libcurl.

This vulnerability exists in older versions of the libcurl library and curl tool, and the official version 8.4.0 update released on October 11, 2023 has fixed the above two vulnerabilities.

Microsoft Windows 10 and Win11 systems come with curl by default, and October 11 is Microsoft's Patch Tuesday activity day, so it was speculated that this month's cumulative update would include a new version of 8.4.0, but users found that they still stayed in the outdated curl version after upgrading.

CTOnews.com Note: Curl is an open source network request command line tool developed since 1998. It has rich Api and Abi (application binary interface) and is widely used in cars, TVs, routers, printers, audio devices, mobile phones, tablets, medical devices, set-top boxes, computer games, media players and other devices.

Curl is the internet delivery engine for thousands of software applications, with more than 20 billion installations, and almost every internet user uses curl on a daily basis. Widely used as a component for HTTP requests, libcurl is also a very popular and widely used web library, widely used for writing web applications and clients.