Tux Machines

A bug that was 23 years old or not

Posted by Roy Schestowitz on Sep 05, 2022

Firefox 105 Includes Gesture Navigation, PDF Annotation + More

Announcing the release of Apache AGE 1.1.0

The vulnerable code has been in curl versions since version 4.9 which makes it exactly 8,729 days (23.9 years) until the shipped version 7.85.0 that fixed it. It also means that we introduced the bug on project day 201 and fixed it on day 8,930.

The code was not problematic when it shipped and it was not problematic during a huge portion of the time it has been used by a large amount of users.

It become problematic when HTTP servers started to refuse HTTP requests they suspected could be malicious. The way this code turned into a denial of service was therefore more or less just collateral damage. An unfortunate side effect.

Maybe the bug was born first when RFC 6265 was published. Maybe it was born when the first widely used HTTP server started to reject these requests.

Read on

↺ Read on

Also: 3 things to know about planning for OTA updates in your homelab | Opensource.com

↺ 3 things to know about planning for OTA updates in your homelab | Opensource.com

gemini.tuxmachines.org