The curl project is opening its vulnerability management process to the public, encouraging community members to inspect issue reports and critique severity ratings. Reports under evaluation are tracked with labels such as vuln:ASSESS, vuln:NONE, vuln:LOW, and vuln:MEDIUM to categorize security impacts openly. Confirmed vulnerabilities will receive CVE IDs and advisories prepared inside the curl-www repository alongside immediate bug fixes. While discussions and CVE assignments remain visible in curl's repositories throughout development, the project will hold back official publications to the broader CVE database until the release date of the patched software.
Key points
Public scrutiny on GitHub is intended to help maintainers detect overlooked risks and man…: Public scrutiny on GitHub is intended to help maintainers detect overlooked risks and manage the triage workload.
The project allows maintainers to reassess and alter assigned severity ratings whenever c…: The project allows maintainers to reassess and alter assigned severity ratings whenever convincing counterarguments are presented.
Fixes for confirmed flaws are merged immediately upon completion, even as broader databas…: Fixes for confirmed flaws are merged immediately upon completion, even as broader database notifications wait for release day.
Sources checked by our analysis pipeline: 1
I recently blogged about how the curl project switched to doing all handling of vulnerabilities at severity LOW and MEDIUM in the public.
Let me now describe how you can follow along this process and help out. Add your opinions, comments and assessments to help the curl project stay honest, do even better and manage the load.
Issues
Vulnerability reports are now submitted directly in curl’s issue tracker on GitHub. Judging by the initial set received, the persons submitting them do not particularly highlight the security angle in the title but it is instead implied or specified in the issue description. I hope people react if we somehow miss it.
Tags
We use a set of tags to manage vulnerability reports on GitHub. They are all prefixed by vuln:.
vuln:ASSESS
Every submitted issue that has a claimed or suspected security angle – a possible vulnerability – first gets the vuln:ASSESS
tag set (by one of the curl maintainers). This tag marks the issue as one that we should evaluate, assess and determine first if it is a vulnerability, and if…
The unauthorized intrusion compromised customer names, travel itineraries, and reference numbers after attackers breached the external software vendor's platform. Singapore Airlines confirmed that its own IT infrastructure remained secure, with financial data and credit card details left untouched. The incident reflects a broader supply chain disruption that has swept across multiple major carriers throughout the Asia-Pacific region.
Grocery locations throughout the continent were thrown into disarray after malicious actors infiltrated essential cooling infrastructure. The digital sabotage manipulated climate controls, forcing store managers to confront compromised refrigeration units. Operations remain hindered as affected retail chains evaluate the damage to their daily capabilities.
Hackers are remotely tampering with internet-connected commercial cooling systems across European grocery chains to drive up temperatures and intentionally spoil inventory. Cybersecurity experts determined the intrusions exploited vulnerable controller units that lacked recent software patches or were simply too outdated to receive updates. The disruptive campaign follows a destructive October incident in France, raising alarms over systemic vulnerabilities within critical food-supply infrastructure.