This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(99.2, 70%, 19%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAM%3C/text%3E%3C/svg%3E)
Any ETA when a patch for cURL 8.4.0 will be released. We currently see that cURL 8.4.0 has been released by the cURL project, but Microsoft hasn't released a patch for this? We need to get this patched immediately on our Windows 10 and Server appliances.
Our team has attempted to copy and paste the new version of cURL, but it appears that it reverts to the old version of cURL when a hardlink exists to the Windows Component Store. The only viable route would be to have Microsoft release a patch.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(16, 0%, 11%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECL%3C/text%3E%3C/svg%3E)
What are we supposed to do here Microsoft ?!? Deleting the file breaks system updates, manually updating is failing!!!
had this break a couple of systems on testing. You can easily fix it with, but it reverts to the original curl file.
dism /Online /Cleanup-Image /RestoreHealth
sfc /scannow
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(57.599999999999994, 5%, 15%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ERB%3C/text%3E%3C/svg%3E)
We really need some guidance from Microsoft on this issue.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(51.2, 83%, 14%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
@Chris Leonard (MS) You can create a folder for external curl (released by the cURL project), e.g.: C:\cURL
then add that folder to PATH system environment, prepending "%SystemRoot%\system32"
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(176, 1%, 27%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETS%3C/text%3E%3C/svg%3E)
Hi, someone applied the workaround suggested by Microsoft to mitigate this vulnerability and worked? I tested the Policy, but the Curl keep working after apply the policy and restart the device.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(86.4, 57.00000000000001%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EDJ%3C/text%3E%3C/svg%3E)
I just found this... for what it's worth.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38039
Here's the so-called "fix" https://answers.microsoft.com/en-us/windowserver/forum/all/how-to-update-curl-version-to-840/96edfd33-9316-4232-825b-bfb4ef147d6f My guess is that this is temporary and MS will release something next week on Tuesday.
curl.exe 8.4.0.0 will be included with 2023-11 LCUs:
KB5032196: Win10 1809
KB5032189: Win10 22H2
KB5032198: Server 2022
KB5032192: Win11 21H2
KB5032190: Win11 22H2/23H2
KB5032202: Server 23H2
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(67.2, 35%, 16%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EER%3C/text%3E%3C/svg%3E)
Just patched with KB5032196, and cURL is still showing as 7.71.1. I also did not see anything mentioning cURL in the release notes. Did you observe something differently?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(150.4, 27%, 24%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ENJ%3C/text%3E%3C/svg%3E)
Hi @abbodi86
When it would be available for the Windows 2019 server?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(288, 64%, 37%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ETH%3C/text%3E%3C/svg%3E)
Artic Wolf is showing this as a MySql vuln but nothing shows in Defender for Endpoint. Where's the patch?
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(313.6, 55.00000000000001%, 40%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EHL%3C/text%3E%3C/svg%3E)
Hello Alexis Martinez
Microsoft has included curl.exe version 8.4.0 in the Windows Update released on November 14, 2023, for currently supported on-premises versions of Windows clients and servers.
You need to manually add the patch of the corresponding version from https://www.catalog.update.microsoft.com/Home.aspx, please refer to this link for the patch of the corresponding version:
Best Regards,
Hania Lian