We currently use curl 7.77 unless using windows, then we use 7.67 (because of some bug). Upgrading to 8.x could require some code changes on our side due to non-backward compatible stuff.
The socks5+curl bug linked above only affects people compiling Hush, not people that run full nodes from binaries/packages.
For the bug to affect compilers, they would need to be using an OS-level socks5 proxy for all traffic and use a socks5 proxy which is malicious that they do not control.
https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/
https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/
We currently use curl 7.77 unless using windows, then we use 7.67 (because of some bug). Upgrading to 8.x could require some code changes on our side due to non-backward compatible stuff.
The socks5+curl bug linked above only affects people compiling Hush, not people that run full nodes from binaries/packages.
For the bug to affect compilers, they would need to be using an OS-level socks5 proxy for all traffic and use a socks5 proxy which is malicious that they do not control.
This can be done directly on the dev branch. I would say leave alone the the version that will be used on windows. The person who is able to test it on windows can change it.
This issue involves updating this file : https://git.hush.is/hush/hush3/src/branch/master/depends/packages/libcurl.mk
This can be done directly on the dev branch. I would say leave alone the the version that will be used on windows. The person who is able to test it on windows can change it.
jahway603
https://daniel.haxx.se/blog/2023/10/11/curl-8-4-0/
https://daniel.haxx.se/blog/2023/10/11/how-i-made-a-heap-overflow-in-curl/
We currently use curl 7.77 unless using windows, then we use 7.67 (because of some bug). Upgrading to 8.x could require some code changes on our side due to non-backward compatible stuff.
The socks5+curl bug linked above only affects people compiling Hush, not people that run full nodes from binaries/packages.
For the bug to affect compilers, they would need to be using an OS-level socks5 proxy for all traffic and use a socks5 proxy which is malicious that they do not control.
This issue involves updating this file : https://git.hush.is/hush/hush3/src/branch/master/depends/packages/libcurl.mk
This can be done directly on the dev branch. I would say leave alone the the version that will be used on windows. The person who is able to test it on windows can change it.
Done on
devbranch