Fedora considers curl-minimal [LWN.net]

Fedora considers curl-minimal

Posted Mar 11, 2022 14:11 UTC (Fri) by bagder (guest, #38414)
Parent article: Fedora considers curl-minimal

> Even if a program is using a URL with an http scheme (i.e. protocol), the (possibly malicious) server could redirect to a different URL with a different protocol entirely, which would then invoke that code in curl if it is present

That was true until curl 7.65.2, released on Jul 17 2019. Since then there's a separate option for setting which protocols curl accepts redirects to, which defaults to HTTP, HTTPS, FTP and FTPS.

/ Daniel

to post comments

Fedora considers curl-minimal

Posted Mar 14, 2022 14:47 UTC (Mon) by Paf (subscriber, #91811) [Link] (1 responses)

An option which no doubt is rigorously set by all users at all times. “Options” for doing the secure thing are borderline meaningless in most situations unless they’re shipped on by default.

Fedora considers curl-minimal

Posted Mar 14, 2022 22:10 UTC (Mon) by bagder (guest, #38414) [Link]

Let me repeat myself:

"which defaults to HTTP, HTTPS, FTP and FTPS"