How to update Curl version to 8.4.0?

Question

From our security scan we have a higher vulnerability of curl version 7.68 on Windows server 2022 and the recommended to fix the vulnerability is to update curl to 8.4.0 or above version . Please have a look and advise.

Regard,

Hamimu.

Answer 1

Really.... Yeah,.. because I totally have time for doing that **** 220+ times all over the network. 😡 Curl freaking sucks! Microsoft never should have adopted it. We did without it just fine before and we sure as hell don't need it now. What an unworthy piece of ****. Microsoft should have known that just by it's stupid name being indicative of being garbage. **** curl!

Answer 2

C:\Windows\System32\curl.exe & C:\Windows\Wow64\curl.exe files are owned by Trsuted Installer, so renaming is not that simple.

One need to take ownership, rename, etc. etc. There must be installer way of doing this rather than tinkering with system files.

Answer 3

Do NOT manually update C:\Windows\System32\curl.exe with the above instructions. Those instructions should only be use with manually installed versions of curl. Instead, the only way to update C:\Windows\System32\curl.exe is through installation of KB5025221 or a later Cumulative Update from Microsoft.

This article is straight from the developer/creator of curl: https://daniel.haxx.se/blog/2023/04/24/deleting-system32curl-exe/comment-page-1/

In the article, he says directly, "...I have stressed at every opportunity that it is a horrible idea to remove the system curl or to replace it with another executable. It is very easy to download a fresh curl install for Windows from the curl site – but we still strongly discourage everyone from replacing system files." He then goes on to explain that trying to manually fix it can cause more problems than it fixes.

Answer 4

Do NOT manually update C:\Windows\System32\curl.exe with the above instructions. Those instructions should only be use with manually installed versions of curl. Instead, the only way to update C:\Windows\System32\curl.exe is through installation of KB5025221 or a later Cumulative Update from Microsoft.

Answer 5

The curl shipped by Microsoft : https://curl.se/windows/microsoft.html... the last package for Windows by curl : https://curl.se/windows/