http://permalink.gmane.org/gmane.comp.web.curl.announce hourly 1 1901-01-01T00:00+00:00 http://gmane.org/img/gmane-25t.png http://gmane.org http://permalink.gmane.org/gmane.comp.web.curl.announce/67 <pre>Hello friends! I'm glad to once again tell you about an updated curl and libcurl package. I missed our 14th anniversary with just two days but instead I hope we have a bug or two fewer included! As usual, fetch it from http://curl.haxx.se/ Enjoy! Curl and libcurl 7.25.0 Public curl releases: 127 Command line options: 151 curl_easy_setopt() options: 199 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 929 This release includes the following changes: o configure: add option disable --libcurl output [1] o --ssl-allow-beast and CURLOPT_SSL_OPTIONS added [2] o Added CURLOPT_TCP_KEEPALIVE, CURLOPT_TCP_KEEPIDLE, CURLOPT_TCP_KEEPINTVL [4] o curl: use new library-side TCP_KEEPALIVE options [5] o Added a new CURLOPT_MAIL_AUTH option [13] o Added support for --mail-auth [14] o --libcurl now also works with -F and more! [15] This release includes the following bugfixes: o --max-redirs: allow negative numbers as option</pre> Daniel Stenberg 2012-03-22T19:04:15 http://permalink.gmane.org/gmane.comp.web.curl.announce/66 <pre> curl URL sanitization vulnerability =================================== Project cURL Security Advisory, January 24th 2012 http://curl.haxx.se/docs/security.html 1. VULNERABILITY curl is vulnerable to a data injection attack for certain protocols through control characters embedded or percent-encoded in URLs. When parsing URLs, libcurl's parser is very laxed and liberal and only parses as little as possible and lets as much as possible through as long as it can figure out what to do. In the specific process when libcurl extracts the file path part from a given URL, it didn't always verify the data or escape control characters properly before it passed the file path on to the protocol-specific code that then would use it for its protocol business. This passing through of control characters could be exploited by someone who would be able to pass in a handicrafted URL to libcurl. Lots of libcurl using applications let users ent</pre> Daniel Stenberg 2012-01-24T09:18:42 http://permalink.gmane.org/gmane.comp.web.curl.announce/65 <pre> curl SSL CBC IV vulnerability ============================= Project cURL Security Advisory, January 24th 2012 http://curl.haxx.se/docs/security.html 1. VULNERABILITY curl is vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL for the SSL/TLS layer. This vulernability has been identified (CVE-2011-3389) and is addressed by OpenSSL already as they have made a work-around to mitigate the problem. When doing so, they figured out that some servers didn't work with the work-around and offered a way to disable it. The bit used to disable the workaround was then added to the generic SSL_OP_ALL bitmask that SSL clients may use to enable work-arounds for better compatibility with servers. libcurl uses the SSL_OP_ALL bitmask. While SSL_OP_ALL is documented to enable "rather harmless" work-arounds, it does in this case effectively enable this security vulnerability again. There is no known exploit for this problem</pre> Daniel Stenberg 2012-01-24T09:18:50 http://permalink.gmane.org/gmane.comp.web.curl.announce/64 <pre>Hello! I'm happy to announce that I've just packaged and uploaded another curl release. We've fixed many bugs and added a bunch of new features. As usual you get it from http://curl.haxx.se/ This time we also ship two security fixes, announced separately just within moments from now. Curl and libcurl 7.24.0 Public curl releases: 127 Command line options: 149 curl_easy_setopt() options: 192 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 907 This release includes the following security fixes: o curl was vulnerable to a data injection attack for certain protocols http://curl.haxx.se/docs/adv_20120124.html o curl was vulnerable to a SSL CBC IV vulnerability when built to use OpenSSL http://curl.haxx.se/docs/adv_20120124B.html This release includes the following changes: o CURLOPT_QUOTE: SFTP supports the '*'-prefix now [24] o CURLOPT_DNS_SERVERS: set name servers if possible [23] o Add support for using ne</pre> Daniel Stenberg 2012-01-24T09:17:57 http://permalink.gmane.org/gmane.comp.web.curl.announce/63 <pre>Hi friends, As we shipped 7.23.0 with a pretty annoying Windows curl bug - yes, ONLY in the windows version of the curl tool - I decided to build and ship 7.23.1 right away. If you're not using windows or if you only use libcurl, this upgrade offers nothing new. Get 7.23.1 as usual from http://curl.haxx.se/ Curl and libcurl 7.23.1 Public curl releases: 126 Command line options: 149 curl_easy_setopt() options: 192 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 907 This release includes the following bugfixes: o Windows: curl would fail if it found no CA cert, unless -k was used. Even if a non-SSL protocol URL was used This release includes the following known bugs: o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html) This release would not have looked like this without help, code, reports and advice from friends like these: Mark Brand Thanks! (and sorry if I forgot to mention someone) </pre> Daniel Stenberg 2011-11-17T17:27:39 http://permalink.gmane.org/gmane.comp.web.curl.announce/62 <pre>Hi friends, I'm happy to announce that curl and libcurl 7.23.0 have been packaged and uploaded to the site at http://curl.haxx.se/ Curl and libcurl 7.23.0 Public curl releases: 125 Command line options: 149 curl_easy_setopt() options: 192 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 873 This release includes the following changes: o Empty headers can be sent in HTTP requests by terminating with a semicolon o SSL session sharing support added to curl_share_setopt() o Added support to MAIL FROM for the optional SIZE parameter o smtp: Added support for NTLM authentication o curl tool: code split into tool_*.[ch] files This release includes the following bugfixes: o handle HTTP redirects to "//hostname/path" o SMTP without --mail-from caused segfault o prevent extra progress meter headers between multiple files o allow Content-Length to be replaced when sending HTTP requests o curl now always sets postfie</pre> Daniel Stenberg 2011-11-15T21:28:34 http://permalink.gmane.org/gmane.comp.web.curl.announce/61 <pre>Hi! I'm happy to announce that curl and libcurl version 7.22.0 have just been uploaded to the site. Get it from http://curl.haxx.se/ Curl and libcurl 7.22.0 Public curl releases: 124 Command line options: 149 curl_easy_setopt() options: 192 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 873 This release includes the following changes: o Added CURLOPT_GSSAPI_DELEGATION o Added support for NTLM delegation to Samba's winbind daemon helper ntlm_auth o Display notes from setup file in testcurl.pl o BSD-style lwIP TCP/IP stack experimental support on Windows o OpenSSL: Use SSL_MODE_RELEASE_BUFFERS if available o --delegation was added to set CURLOPT_GSSAPI_DELEGATION o nss: start with no database if the selected database is broken o telnet: allow programatic use on Windows This release includes the following bugfixes: o curl_getdate: detect some illegal dates better o when sending a request and an error is re</pre> Daniel Stenberg 2011-09-13T17:35:42 http://permalink.gmane.org/gmane.comp.web.curl.announce/60 <pre> libcurl inappropriate GSSAPI delegation ======================================= Project cURL Security Advisory, June 23rd 2011 http://curl.haxx.se/docs/security.html 1. VULNERABILITY When doing GSSAPI authentication, libcurl unconditionally performs credential delegation. This hands the server a copy of the client's security credentials, allowing the server to impersonate the client to any other using the same GSSAPI mechanism. This is obviously a very sensitive operation, which should only be done when the user explicitly so directs. The GSS/Negotiate feature is only used by libcurl for HTTP authentication if told to, and only if libcurl was built with a library that provides the GSSAPI. Many builds of libcurl don't have GSS enabled. There is no known exploit for this problem. The Common Vulnerabilities and Exposures (CVE) project has assigned the name CVE-2011-2192 to this issue. 2. AFFECTED VERSIONS Affected versions: curl</pre> Daniel Stenberg 2011-06-23T09:39:09 http://permalink.gmane.org/gmane.comp.web.curl.announce/59 <pre>Hi friends, I'm happy to tell you that curl and libcurl 7.21.7 have just been uploaded. This time with an associated security advisory. Enjoy! Curl and libcurl 7.21.7 Public curl releases: 123 Command line options: 144 curl_easy_setopt() options: 186 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 868 This release includes the following changes: o recognize the [protocol]:// prefix in proxy hosts where the protocol is one of socks4, socks4a, socks5 or socks5h. o Added CURLOPT_CLOSESOCKETFUNCTION and CURLOPT_CLOSESOCKETDATA This release includes the following bugfixes: o SECURITY ADVISORY: inappropriate GSSAPI delegation. Full details at http://curl.haxx.se/docs/adv_20110623.html o NTLM: work with unicode o fix connect with SOCKS proxy when using the multi interface o anyauthput.c: stdint.h must not be included unconditionally o CMake: improved build o SCP/SFTP enable non-blocking earlier o GnuTLS </pre> Daniel Stenberg 2011-06-23T09:38:57 http://permalink.gmane.org/gmane.comp.web.curl.announce/58 <pre>Hi friends! Due to the significant bug with the broken HTTPS over HTTP proxy, I've packaged a new release and uploaded it to the site. Get it as usual from http://curl.haxx.se/ Since this release comes just a few days after the previous release, we of course have not done many changes but I'm still listing them below. Curl and libcurl 7.21.6 Public curl releases: 122 Command line options: 144 curl_easy_setopt() options: 186 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 865 This release includes the following changes: o Added --tr-encoding and CURLOPT_TRANSFER_ENCODING This release includes the following bugfixes: o curl-config: fix --version o curl_easy_setopt.3: CURLOPT_PROXYTYPE clarification o use HTTPS properly after CONNECT o SFTP: close file before post quote operations This release includes the following known bugs: o see docs/KNOWN_BUGS (http://curl.haxx.se/docs/knownbugs.html) This release wou</pre> Daniel Stenberg 2011-04-22T17:30:34 http://permalink.gmane.org/gmane.comp.web.curl.announce/57 <pre>Hi friends! I'm happy to once again be able to let you know that we have a new release out. It counts no less than 5 changes and 41 bugfixes made during the 58 days since the previous release. As usual this is a team effort and the great people behind this release are mentioned below. Remember to buy them a beer if you ever run into one of them! As usual, run over to http://curl.haxx.se/ to download the code. We keep track of all the binary packages we know of, but they will of course take some time to get updated. The details for this particular release is listed below. Curl and libcurl 7.21.5 Public curl releases: 121 Command line options: 143 curl_easy_setopt() options: 185 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 854 This release includes the following changes: o SOCKOPTFUNCTION: callback can say already-connected o Added --netrc-file o Added (new) support for cyassl o TSL-SRP: enabled with OpenSSL </pre> Daniel Stenberg 2011-04-17T21:33:15 http://permalink.gmane.org/gmane.comp.web.curl.announce/56 <pre>Hi friends! For the 120th time, I have the pleasure of announcing another release. It's taken us 64 days since the previous release and we offer you 29 bugfixes and 7 changes. Enjoy! Get 7.21.4 from the usual place: http://curl.haxx.se/ Curl and libcurl 7.21.4 Public curl releases: 120 Command line options: 143 curl_easy_setopt() options: 185 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 834 This release includes the following changes: o CURLINFO_FTP_ENTRY_PATH now supports SFTP o introduced new framework for unit-testing o IDN: use win32 API if told to o ares: ask for both IPv4 and IPv6 addresses o HTTP: do Negotiate authentication using SSPI on windows o Windows build: alternative makefile o TLS-SRP: support added when using GnuTLS This release includes the following bugfixes: o SMTP: add brackets for MAIL FROM o ossl_seed: no more RAND_screen (on Windows) o multi: connect fail =&gt; use next IP addre</pre> Daniel Stenberg 2011-02-17T13:08:37 http://permalink.gmane.org/gmane.comp.web.curl.announce/55 <pre>Hi friends, I'm very happy to present yet another release. 7.21.3 is primarily is a range of bug fixes. Curl and libcurl 7.21.3 Public curl releases: 119 Command line options: 143 curl_easy_setopt() options: 185 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 827 This release includes the following changes: o Added --noconfigure switch to testcurl.pl o Added --xattr option o Added CURLOPT_RESOLVE and --resolve o Added CURLAUTH_ONLY o Added version-check.pl to the examples dir This release includes the following bugfixes: o check for libcurl features for some command line options o Curl_setopt: disallow CURLOPT_USE_SSL without SSL support o http_chunks: remove debug output o URL-parsing: consider ? a divider o SSH: avoid using the libssh2_ prefix o SSH: use libssh2_session_handshake() to work on win64 o ftp: prevent server from hanging on closed data connection when stopping a transfer before the </pre> Daniel Stenberg 2010-12-15T14:34:45 http://permalink.gmane.org/gmane.comp.web.curl.announce/54 <pre>Hi friends, I'm very happy to announce a fresh curl and libcurl release. This time we mostly provide a series of bug fixes, including a security vulnerability fix. We're now officially beyond 1500 bug fixes made since curl 6.0, which happened over 4000 days ago... Thank you everyone who keep providing help, patches, support, advice and more! Get curl, as usual, from http://curl.haxx.se/download.html Curl and libcurl 7.21.2 Public curl releases: 118 Command line options: 138 curl_easy_setopt() options: 180 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 817 This release includes the following changes: o curl -T: ignore file size of special files o Added GOPHER protocol support o Added mk-ca-bundle.vbs script o c-ares build now requires c-ares &gt;= 1.6.0 This release includes the following bugfixes: o --remote-header-name security vulnerability fixed: http://curl.haxx.se/docs/adv_20101013.html o multi: supp</pre> Daniel Stenberg 2010-10-12T22:07:59 http://permalink.gmane.org/gmane.comp.web.curl.announce/53 <pre>Hello friends, I'm glad to yet again announce another release. curl and libcurl 7.21.1 was uploaded just a short while ago. Get it as usual from: http://curl.haxx.se/ The RELEASE-NOTES for this step along the endless road follows here: Curl and libcurl 7.21.1 Public curl releases: 117 Command line options: 138 curl_easy_setopt() options: 180 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 808 This release includes the following changes: o maketgz: produce CHANGES automatically o added support for NTLM authentication when compiled with NSS o build: Enable configure --enable-werror o curl-config: --built-shared returns shared info This release includes the following bugfixes: o configure: spell --disable-threaded-resolver correctly o multi: call the progress callback in all states o multi: unmark handle as used when no longer head of pipeline o sendrecv: treat all negative values from send/recv as errors </pre> Daniel Stenberg 2010-08-11T21:50:29 http://permalink.gmane.org/gmane.comp.web.curl.announce/52 <pre>Hi friends, I'm very happy to again announce a public release in the never-ending series of curl and libcurl. This time, 7.21.0 is here with lots of new bells and whistles and a bunch of bugs fixed. As usual, get it from http://curl.haxx.se/ Curl and libcurl 7.21.0 Public curl releases: 116 Command line options: 138 curl_easy_setopt() options: 180 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 794 This release includes the following changes: o added the --proto and -proto-redir options o new configure option --enable-threaded-resolver o improve TELNET ability with libcurl o added support for PolarSSL o added support for FTP wildcard matching and downloads o added support for RTMP o introducing new LDAP code for new enough OpenLDAP o OpenLDAP support enabled for cygwin builds o added CURLINFO_PRIMARY_PORT, CURLINFO_LOCAL_IP and CURLINFO_LOCAL_PORT This release includes the following bugfixes: o prevent </pre> Daniel Stenberg 2010-06-16T12:04:11 http://permalink.gmane.org/gmane.comp.web.curl.announce/51 <pre>Hi friends! I'm glad to announce that we've just uploaded another curl and libcurl release. Version 7.20.1 is now up on the site. Get it at http://curl.haxx.se/ Curl and libcurl 7.20.1 Public curl releases: 115 Command line options: 136 curl_easy_setopt() options: 174 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 776 This release includes the following changes: o The 'ares' subtree has been removed from the source repository o smoother rate limiting o allow user+password in the URL for all protocols o POP3: Get message listing if no mailbox in URL This release includes the following bugfixes: o VMS builder bad behavior when used in a batch job o multiple recepients with SMTP o fixed the CURL_FORMAT_* defines when building with cmake o missing quote in libcurl.m4 o SMTP: now waits for 250 after the DATA transfer o SMTP: use angle brackets in RCPT TO o curl --trace-time not using local time o off-</pre> Daniel Stenberg 2010-04-14T15:45:50 http://permalink.gmane.org/gmane.comp.web.curl.announce/50 <pre>Hi friends! I'm happy to yet again announce that we've packed a new release of curl and libcurl. This time we've added new protocols, new features, fixed a security related flaw and corrected almost 30 bugs. curl and libcurl 7.20.0 holds more changes than we've done for a release in a very long time. Curl and libcurl 7.20.0 Public curl releases: 114 Command line options: 136 curl_easy_setopt() options: 174 Public functions in libcurl: 58 Known libcurl bindings: 39 Contributors: 761 This release includes the following changes: o support SSL_FILETYPE_ENGINE for client certificate o curl-config can now show the arguments used when building curl o non-blocking TFTP o send Expect: 100-continue for POSTs with unknown sizes o added support for IMAP(S), POP3(S), SMTP(S) and RTSP o added new curl_easy_setopt() options for SMTP and RTSP o added --mail-from and --mail-rcpt for SMTP o VMS build system enhancements o added support for the PRET</pre> Daniel Stenberg 2010-02-09T11:38:23 http://permalink.gmane.org/gmane.comp.web.curl.announce/49 <pre>Hi friends! I'm happy to announce that I've just published curl and libcurl 7.19.7 on the web site: http://curl.haxx.se/download.html This is most probably the best release we've done so far, and the focus has been on fixing bugs. So, please enjoy! Curl and libcurl 7.19.7 Public curl releases: 113 Command line options: 132 curl_easy_setopt() options: 163 Public functions in libcurl: 58 Known libcurl bindings: 38 Contributors: 732 This release includes the following changes: o -T. is now for non-blocking uploading from stdin o SYST handling on FTP for OS/400 FTP server cases o libcurl refuses to read a single HTTP header longer than 100K o added the --crlfile option to curl This release includes the following bugfixes: o The windows makefiles work again o libcurl-NSS acknowledges verifyhost o SIGSEGV when pipelined pipe unexpectedly breaks o data corruption issue with re-connected transfers o use after free if we're completed </pre> Daniel Stenberg 2009-11-04T12:57:24 http://permalink.gmane.org/gmane.comp.web.curl.announce/48 <pre>Hi friends, I'm happy to ship another release of curl and libcurl. The 7.19.6 release has a few added features and bug fixes, and possibly most importantly it fixes a security problem (CVE-2009-2417) which I'll post about separately just after this mail. Get your package from http://curl.haxx.se/ - of course the binary packages have not yet been updated but the source packages are there. Curl and libcurl 7.19.6 Public curl releases: 112 Command line options: 132 curl_easy_setopt() options: 163 Public functions in libcurl: 58 Known libcurl bindings: 38 Contributors: 715 This release includes the following changes: o CURLOPT_FTPPORT (and curl's -P/--ftpport) support port ranges o Added CURLOPT_SSH_KNOWNHOSTS, CURLOPT_SSH_KEYFUNCTION, CURLOPT_SSH_KEYDATA o CURLOPT_QUOTE, CURLOPT_POSTQUOTE and CURLOPT_PREQUOTE can be told to ignore error responses when used with FTP This release includes the following bugfixes: o crash on bad socket clo</pre> Daniel Stenberg 2009-08-12T09:11:52 Search the mailing list at Gmane query http://search.gmane.org/?group=$group=gmane.comp.web.curl.announce