Hello #MITRE, (regarding CVE-2023-52071)
Well, first I of course think that the "burden of proof" would be on the person that insists that there is a problem. The one saying that this is a #CVE should provide the necessary details to explain "beyond reasonable doubt" that the identified problem is a vulnerability. There are no such details or explanations provided in the existing CVE. There is nothing there that identifies a vulnerability.
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •I'm convinced someone just grepped commit messages for this and submitted a #CVE and there was nothing and no one that even tried to confirm or check that this was actually legitimate. There was no filter in place and it was incorrectly let through. That's why it should be rejected. Saying it is "disputed" hints that there can be different views on this subject.
So, you are asking me to explain how this not identified vulnerability is actually not identifying a vulnerability.
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •Let me try:
The claimed issue identifies a bug in curl that
1. only existed in debug-builds (thus disqualified)
2. even in debug-builds, a bad access will at worst cause a crash, which is also what assert itself does when triggered. Thus having the same end result. Not a vulnerability.
3. in most situations, the bad access will not cause any problems at all, even in debug-builds (because the accessed stack memory is readable)
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •My claims can easily be verified and double-checked by simply reading the code. It's not complicated.
/ Daniel
maswan
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to maswan • • •timthelion
in reply to daniel:// stenberg:// • • •I'd like to file a CVE against Daniel Stenberg. He can easily DOSed simply by telling him that there is a security vulnerability in curl. Daniel is a key piece of internet infrastructure responsible for maintaining mission critical software.
Unfortunately, he can be put out of service for hours simply by putting a number next to the letters C.V. and E This needs to be patched immediately. Where can I report this?
daniel:// stenberg://
in reply to daniel:// stenberg:// • • •curl - Bogus report filed by anonymous - CVE-2023-52071
curl.seDiego Barros
in reply to daniel:// stenberg:// • • •the vessel of morganna
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to the vessel of morganna • • •mort
in reply to daniel:// stenberg:// • • •sigi714
in reply to daniel:// stenberg:// • • •¯\_(ツ)_/¯