Share via

How to update Curl version to 8.4.0?

Anonymous
2023-11-05T04:38:45+00:00

From our security scan we have a higher vulnerability of curl version 7.68 on Windows server 2022 and the recommended to fix the vulnerability is to update curl to 8.4.0 or above version . Please have a look and advise.

Regard,

Hamimu.

Windows for business Windows Server Devices and deployment Set up, install, or upgrade

Locked Question. This question was migrated from the Microsoft Support Community. You can vote on whether it's helpful, but you can't add comments or replies or follow the question. To protect privacy, user profiles for migrated questions are anonymized.

0 comments

15 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.

    Comments have been turned off. Learn more

  2. Anonymous
    2023-11-07T15:44:17+00:00

    This is not for installations that ship with windows! MS need to ship the updated curl.exe since they made it part of the system.

    The maintainer himself advises the following: https://daniel.haxx.se/blog/2023/04/24/deleting-system32curl-exe/

    Please advise when MS are going to do this.

    Thanks

    17 people found this answer helpful.
    0 comments
  3. Anonymous
    2023-11-08T00:59:15+00:00

    so what KB MS provided to update to Curl 8.4?

    5 people found this answer helpful.
    0 comments
  4. Anonymous
    2023-11-08T08:24:25+00:00

    so what KB MS provided to update to Curl 8.4?

    There isn't any. Check their CVE page daily if and when patches are released-->

    CVE-2023-38545 - Security Update Guide - Microsoft - MITRE: CVE-2023-38545 SOCKS5 heap buffer overflow

    Microsoft is fully aware of this issue and is actively working to release version 8.4.0 of curl.exe in a future Windows update for currently supported, on-premise versions of Windows clients and servers. The Security Updates table for this CVE will be updated with the Windows update KB numbers for all supported versions as they are released

    9 people found this answer helpful.
    0 comments
  5. Anonymous
    2023-11-20T14:24:29+00:00

    Hello everyone there is a way to update this vulnerability I was able to do it successfully on Windows server 2019.

    Step 1: Go to https://www.msys2.org/ and download the installer. Also Git will need to be installed as well https://git-scm.com/downloads

    Step 2: After downloading MSYS2, open the application. Copy the following commands in order. If you're doing it from the command prompt , use "set" instead of "export".

    • pacman -S --needed git base-devel mingw-w64-x86_64-toolchain
    • source shell mingw64
    • git clone https://github.com/microsoft/vcpkg.git
    • cd vcpkg
    • ./bootstrap-vcpkg.bat
    • export VCPKG_DEFAULT_TRIPLET=x64-mingw-dynamic
    • export VCPKG_DEFAULT_HOST_TRIPLET=x64-mingw-dynamic
    • ./vcpkg install curl

    You should now have the latest curl 8.4.0! :)

    User's image

    References: https://learn.microsoft.com/en-us/vcpkg/users/platforms/mingw

    https://github.com/microsoft/vcpkg#quick-start-windows

    1 person found this answer helpful.
    0 comments