@bagder does this qualify as code bloat? the user agent...

@bagder does this qualify as code bloat? the user agent header is completely arbitrary and can be set to anything.
I mean why single out curl. Shouldn’t the nmap default user agent be in there too? etc etc

Like 16 April at 22:14 | Wall-to-wall | Open on ioc.exchange

3 comments

daniel:// stenberg://

@spmatich they singled out curl because the exploit proof of concept used curl. They stopped the example command line from working.

16 April at 22:15 | Open on mastodon.social

spmatich :blobcoffee:

@bagder so the exploit just needs an update to include setting the user agent header to something else right, and it could be one of many many many different strings.

16 April at 22:18 | Open on ioc.exchange

daniel:// stenberg://

@spmatich ... and that is exactly why the "fix" is so fun!

16 April at 22:19 | Open on mastodon.social

Go Up