Daniel Stenberg Fights Off Flawed CVE Request on Curl.

Curl Creator Daniel Stenberg Details Ongoing Battles Against 'CVE Hunters' Targeting Open-Source Projects

Daniel Stenberg, the founder and lead maintainer of the ubiquitous open-source tool Curl, has publicly highlighted a persistent headache plagueing open-source maintainers: security researchers relentlessly pushing for CVE (Common Vulnerabilities and Exposures) designations on trivial software bugs.

Since becoming an official CVE Numbering Authority (CNA), Curl has maintained direct control over assigning security vulnerability tracking numbers for its codebase rather than relying on central triage organizations like MITRE. While Curl has legitimately issued 57 CVEs under this program, a recent dispute underscored the growing tension between maintainers and researchers seeking security accolades for non-issues.

The Dispute: Wildcard Certificates and Leading Dots

The controversy stems from a minor parsing bug in Curl regarding TLS/SSL wildcard certificate validation.

Specifically, if a user attempts a connection using a domain name configured with a leading dot (such as .nnewstech.com), Curl accepted a wildcard certificate issued for *.nnewstech.com. The reporter insisted this behavior constituted a serious security vulnerability due to improper certificate validation.

Stenberg and the Curl security team rejected the CVE request, classifying the issue as a harmless operational bug rather than a security exploit. Their rationale centered on practical exploitability:

• Invalid DNS Syntax: Domain names starting with a leading dot cannot be resolved over standard Domain Name System (DNS) protocols.

• Implausible Threat Vector: The scenario can only trigger if a victim manually edits their local system /etc/hosts file to assign an invalid leading-dot domain and explicitly directs it to a malicious server holding the wildcard certificate.

Because the real-world security risk was "lower than low," Curl refused to issue a CVE. Undeterred, the reporter appealed Curl's decision to MITRE multiple times in an attempt to override the maintainers. Following review, MITRE formally upheld Curl's decision, ruling that the bug did not constitute a security vulnerability.

The wider phenomenon of "CVE farming" or "CVE junk" has led many cybersecurity students, automated scanners, and bug-hunting enthusiasts to attempt to bolster their resumes or bug-hunting portfolios by requesting official CVE numbers. This encourages reporters to exaggerate the severity of minor bugs that occur in exceptional cases, placing a massive administrative burden on open-source maintainers who spend hours without compensation reviewing, debating, and rejecting absurd security report submissions.

Before Curl became a CNA, security researchers could easily bypass open-source maintainers by submitting reports directly through third-party intermediaries, resulting in the inappropriate assignment of CVEs to software without the consent of the core developers. By holding its own CNA status, Curl has established stricter criteria for what constitutes a genuine threat, protecting enterprise end users from false security alarms.

A genuine security vulnerability requires a workable threat model in which attackers can remotely compromise data integrity, confidentiality, or availability without requiring the victim to make unusual or non-standard system configuration changes. By adhering to realistic attack conditions, Stenberg helps establish a better industry standard for how open-source projects screen security reports.

Source: haxx.se

💬 AI Content Assistant

Ask me anything about this article. No data is stored for your question.

Curl Creator Daniel Stenberg Details Ongoing Battles Against 'CVE Hunters' Targeting Open-Source Projects

Daniel Stenberg, the founder and lead maintainer of the ubiquitous open-source tool Curl, has publicly highlighted a persistent headache plagueing open-source maintainers: security researchers relentlessly pushing for CVE (Common Vulnerabilities and Exposures) designations on trivial software bugs.

Since becoming an official CVE Numbering Authority (CNA), Curl has maintained direct control over assigning security vulnerability tracking numbers for its codebase rather than relying on central triage organizations like MITRE. While Curl has legitimately issued 57 CVEs under this program, a recent dispute underscored the growing tension between maintainers and researchers seeking security accolades for non-issues.

The Dispute: Wildcard Certificates and Leading Dots

The controversy stems from a minor parsing bug in Curl regarding TLS/SSL wildcard certificate validation.

Specifically, if a user attempts a connection using a domain name configured with a leading dot (such as .nnewstech.com), Curl accepted a wildcard certificate issued for *.nnewstech.com. The reporter insisted this behavior constituted a serious security vulnerability due to improper certificate validation.

Stenberg and the Curl security team rejected the CVE request, classifying the issue as a harmless operational bug rather than a security exploit. Their rationale centered on practical exploitability:

• Invalid DNS Syntax: Domain names starting with a leading dot cannot be resolved over standard Domain Name System (DNS) protocols.

• Implausible Threat Vector: The scenario can only trigger if a victim manually edits their local system /etc/hosts file to assign an invalid leading-dot domain and explicitly directs it to a malicious server holding the wildcard certificate.

Because the real-world security risk was "lower than low," Curl refused to issue a CVE. Undeterred, the reporter appealed Curl's decision to MITRE multiple times in an attempt to override the maintainers. Following review, MITRE formally upheld Curl's decision, ruling that the bug did not constitute a security vulnerability.

The wider phenomenon of "CVE farming" or "CVE junk" has led many cybersecurity students, automated scanners, and bug-hunting enthusiasts to attempt to bolster their resumes or bug-hunting portfolios by requesting official CVE numbers. This encourages reporters to exaggerate the severity of minor bugs that occur in exceptional cases, placing a massive administrative burden on open-source maintainers who spend hours without compensation reviewing, debating, and rejecting absurd security report submissions.

Before Curl became a CNA, security researchers could easily bypass open-source maintainers by submitting reports directly through third-party intermediaries, resulting in the inappropriate assignment of CVEs to software without the consent of the core developers. By holding its own CNA status, Curl has established stricter criteria for what constitutes a genuine threat, protecting enterprise end users from false security alarms.

A genuine security vulnerability requires a workable threat model in which attackers can remotely compromise data integrity, confidentiality, or availability without requiring the victim to make unusual or non-standard system configuration changes. By adhering to realistic attack conditions, Stenberg helps establish a better industry standard for how open-source projects screen security reports.

Source: haxx.se