{"id":28877,"date":"2023-02-25T00:04:16","date_gmt":"2023-02-24T23:04:16","guid":{"rendered":"http:\/\/159.69.82.204\/win\/?p=28877"},"modified":"2024-10-05T19:06:37","modified_gmt":"2024-10-05T17:06:37","slug":"windows-microsoft-liefert-curl-bibliothek-weiterhin-mit-schwachstellen-aus-feb-2023","status":"publish","type":"post","link":"https:\/\/borncity.com\/win\/2023\/02\/25\/windows-microsoft-liefert-curl-bibliothek-weiterhin-mit-schwachstellen-aus-feb-2023\/","title":{"rendered":"Windows 10\/11: Microsoft still ships old version of cURL lib with vulnerabilities (Feb. 2023)"},"content":{"rendered":"

\"Sicherheit[German<\/a>]It's a messy story that I'm posting here on the blog again. Microsoft fails to ship cURL with Windows 10\/11 in such a way that the software is up to date and no longer has known vulnerabilities. I had already raised the issue on the blog in January 2022 – but nothing has changed, as I could see by own checks and in a message received from Stefan Kanthak. Here's a brief outline of what it's all about.<\/p>\n

<\/p>\n

What is cURL?<\/h2>\n

\"\"cURL<\/a> (stands for Client for URLs or Curl URL Request Library) is on the one hand a program library and on the other hand a command line program for transferring files in computer networks. cURL is licensed under the open MIT license and has been ported to various operating systems.<\/p>\n

cURL in Windows 10\/11 is outdated<\/h2>\n

Microsoft has been shipping cURL with Windows 10 (and also in Windows 11) since 2017, as you can read in these articles on the cURL website, as well as Microsoft's blog post Tar and Curl Come to Windows, last updated April 26, 2022. I had addressed it in December 2017 in the German blog post Windows 10: tar und curl sollen kommen<\/a>. The cURL website states:<\/p>\n

All installs of Microsoft Windows 10 and Windows 11 get curl installed by default since then. The initial curl version Microsoft shipped was 7.55.1 but it was upgraded to 7.79.1 in January 2022.<\/p>\n

The Microsoft provided version is built to use the Schannel TLS backend. […]<\/p>\n

The curl tool shipped with Windows is built by and handled by Microsoft. It is a separate build that will have different features and capabilities enabled and disabled compared to the Windows builds<\/a> offered by the curl project. They do however build curl from the same source code. If you have problems with their curl version, report that to them.<\/p>\n

You can probably assume that the curl packages from Microsoft will always lag behind the versions provided by the curl project itself.<\/p><\/blockquote>\n

cURL for Windows has been updated to version 7.88.1 on February 20, 2023 according to the cURL website<\/a>. If I query the cURL version on a Windows 10 with current patch level, I get this display:<\/p>\n

<\/p>\n

Windows 10 22H2 with patch level February 2023 reports a cURL 7.83.1 with a release date of May 13, 2022. They are 9 months behind the official release of the cURL project. If I query the Internet for \"cURL 7.83.1 vulnerabilities\", Google provides me with a link to the official cURL page<\/a>, where it says:<\/p>\n

curl version 7.83.1<\/b> was released on May 11 2022<\/b>. The following 13<\/b> security problems are known to exist in this version.<\/p><\/blockquote>\n

It's kind of silly to see how Microsoft acts. Microsoft's folks blow the fanfares about security features (secure boot, TPM, exploit protection, phishing protection, etc.), but at\u00a0 the same time they ship outdated libraries with known vulnerabilities on the users' systems. This is exactly the same like with products using the Electron framework like Teams – an ancient version of the Chromium browser with known vulnerabilities was also diligently shipped.<\/p>\n

Microsoft knows that<\/h2>\n

One could still argue that \"something was overlooked\". But there is a method to it, the developers in Redmond know this and do nothing. In January 2022, after a hint from Stefan Kanthak, I had already addressed this topic in the blog post Windows January 2022 security updates for cURL vulnerability CVE-2021-22947 \u2013 a tough task for security reporters<\/a>. Kanthak had provided me with communications with Microsoft pointing out security vulnerabilities in cURL.<\/p>\n

The days Stefan Kanthak sent me another email addressing above sloppiness regarding updating cURL in Windows 10 and Windows 11. Here is the text, without further comment on my part – I haven't translated it, because large parts are in English:<\/p>\n

\n
Hello Guenter,\r\n\r\nbeim CC: habe ich dummerweise (D)eine falsche Mail-Adresse angegeben.\r\n\r\nMagst Du ueber deren fortlaufende Schlamperei und Unfaehigkeit, die\r\neigenen Produktionssysteme mit aktuellen Quelltexten zu bestuecken,\r\nschreiben?\r\n\r\nmfg\r\nStefan\r\n\r\n\r\n----- Original Message -----\r\nFrom: \"Stefan Kanthak\" <****>\r\nTo: \"Microsoft Security Response Center\" <secure@microsoft.com>; <certbund@bsi.bund.de>; <cert@cert.org>\r\nCc: <gborn@***>; <daniel@****>\r\nSent: Monday, February 06, 2023 7:56 PM\r\nSubject: TEN unfixed CVEs in the OUTDATED version of curl.exe that Microsoft dares to ship with Windows!\r\n\r\n> Hi @ll,\r\n>\r\n> Microsoft again\/still ships a ROTTEN and VULNERABLE version of curl.exe\r\n> which is 4 releases behind and has TEN unfixed CVEs with Windows 10 and 11!\r\n>\r\n> Why do you ignore your own mantra \"Keep your systems up-to-date and patched\"?\r\n>\r\n> @MSRC: last time it took more than FIVE months, from 2021-07-21 until\r\n>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 January 2022, to ship a version then \"just\" 2 releases behind.\r\n>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 See MSRC Case 66388 CRM:0461283373\r\n>\r\n> @CERT Bund: wie waer's mit einer oeffentlichen Warnung vor diesem\r\n>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 schlampig, fahr- und nachlaessig zusammengefrickelten Kram?\r\n>\r\n> @Daniel: please change your license to forbid the distribution of vulnerable\r\n>\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 binaries built from outdated sources!\r\n>\r\n> C:\\Users\\Stefan>ver\r\n>\r\n> Microsoft Windows [Version 10.0.19044.2486]\r\n>\r\n> C:\\Users\\Stefan>curl --version\r\n> curl 7.83.1 (Windows) libcurl\/7.83.1 Schannel\r\n> Release-Date: 2022-05-13\r\n> Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp\r\n> Features: AsynchDNS HSTS IPv6 Kerberos Largefile NTLM SPNEGO SSL SSPI UnixSockets\r\n>\r\n> From <https:\/\/curl.se\/docs\/security.html<\/a>>\r\n>\r\n> #\u00a0\u00a0\u00a0 S\u00a0 Vulnerability\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 Date\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 First\u00a0\u00a0 Last\r\n> 132\u00a0 ?\u00a0 CVE-2022-43552: HTTP Proxy deny use-after-free\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-12-21\u00a0 7.16.0\u00a0 7.86.0\r\n> 131\u00a0 ?\u00a0 CVE-2022-43551: Another HSTS bypass via IDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-12-21\u00a0 7.77.0\u00a0 7.86.0\r\n> 130\u00a0 ?\u00a0 CVE-2022-42916: HSTS bypass via IDN\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-10-26\u00a0 7.77.0\u00a0 7.85.0\r\n> 129\u00a0 ?\u00a0 CVE-2022-42915: HTTP proxy double-free\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-10-26\u00a0 7.77.0\u00a0 7.85.0\r\n> 128\u00a0 ?\u00a0 CVE-2022-35260: .netrc parser out-of-bounds access\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-10-26\u00a0 7.84.0\u00a0 7.85.0\r\n> 127\u00a0 ?\u00a0 CVE-2022-32221: POST following PUT confusion\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-10-26\u00a0 7.7\u00a0\u00a0\u00a0\u00a0 7.85.0\r\n> 126\u00a0 ?\u00a0 CVE-2022-35252: control code in cookie denial of service\u00a0 2022-08-31\u00a0 4.9\u00a0\u00a0\u00a0\u00a0 7.84.0\r\n> 125\u00a0 ?\u00a0 CVE-2022-32208: FTP-KRB bad message verification\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-06-27\u00a0 7.16.4\u00a0 7.83.1\r\n> 124\u00a0 ?\u00a0 CVE-2022-32207: Unpreserved file permissions\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-06-27\u00a0 7.69.0\u00a0 7.83.1\r\n> 123\u00a0 ?\u00a0 CVE-2022-32206: HTTP compression denial of service\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-06-27\u00a0 7.57.0\u00a0 7.83.1\r\n> 122\u00a0 ?\u00a0 CVE-2022-32205: Set-Cookie denial of service\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 2022-06-27\u00a0 7.71.0\u00a0 7.83.1\r\n>\r\n> NOT AMUSED\r\n> Stefan Kanthak\r\n>\r\n> ----- Original Message -----\r\n> From: \"Stefan Kanthak\" <stefan.kanthak@***>\r\n> To: \"Microsoft Security Response Center\" <secure@microsoft.com>\r\n> Cc: <daniel@***>; <cert@cert.org>\r\n> Sent: Wednesday, July 21, 2021 8:35 PM\r\n> Subject: OUTDATED curl.exe 7.55.1\r\n>\r\n>> Hi secure,\r\n>>\r\n>> Windows 10 20H1, 20H2 and 21H1 ship with an outdated and vulnerable\r\n>> curl.exe 7.55.1, 32 releases and at least 15 (in words: FIFTEEN) CVEs\r\n>> behind the current version 7.78.0: see\r\n>> <https:\/\/curl.se\/docs\/releases.html> and\r\n>> <https:\/\/curl.se\/docs\/vulnerabilities.html>\r\n>>\r\n>> | C:\\Users\\Public>winver\r\n>> | Microsoft Windows [Version 10.0.19042.1083]\r\n>> |\r\n>> | C:\\Users\\Public>curl -V\r\n>> | curl 7.55.1 (Windows) libcurl\/7.55.1 WinSSL\r\n>> | Release-Date: 2017-11-14, security patched: 2019-11-05\r\n>> | Protocols: dict file ftp ftps http https imap imaps pop3 pop3s smtp smtps telnet tftp\r\n>> | Features: AsynchDNS IPv6 Largefile SSPI Kerberos SPNEGO NTLM SSL\r\n>>\r\n>> Are your processes so bad that you can't build a current version and\r\n>> have to ship ROTTEN software instead?\r\n>>\r\n>> NOT amused\r\n>> Stefan Kanthak\r\n<\/pre>\n<\/blockquote>\n
Similar articles:
\n<\/strong>Windows January 2022 security updates for cURL vulnerability CVE-2021-22947 \u2013 a tough task for security reporters<\/a>
\nMicrosoft Teams and it's security<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
[German]It's a messy story that I'm posting here on the blog again. Microsoft fails to ship cURL with Windows 10\/11 in such a way that the software is up to date and no longer has known vulnerabilities. I had already … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[580,1547,2],"tags":[69,1544,76,2643],"class_list":["post-28877","post","type-post","status-publish","format-standard","hentry","category-security","category-software","category-windows","tag-security","tag-software","tag-windows-10","tag-windows-11"],"_links":{"self":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/28877","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/comments?post=28877"}],"version-history":[{"count":1,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/28877\/revisions"}],"predecessor-version":[{"id":35739,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/posts\/28877\/revisions\/35739"}],"wp:attachment":[{"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/media?parent=28877"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/categories?post=28877"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/borncity.com\/win\/wp-json\/wp\/v2\/tags?post=28877"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}