verify-release rebuilds from the tarball under verification, enabling pre-check command execution and false OK for a malicious curl release tarball

访问控制 / Reliance on Untrusted Inputs in a Security Decision / #3802645

厂商

curl

严重程度

低危

赏金

—

弱点

Reliance on Untrusted Inputs in a Security Decision

研究员

@argareksapatii

披露日期

2026-06-17

资产

https://github.com/curl/curl

CVE

—

该报告还没有中文解读。

Summary: `scripts/verify-release` is documented as a way to independently verify a downloaded curl release tarball, but on `curl-8.20.0` it extracts the tarball under verification and executes `./configure` and `./scripts/dmaketgz` before any trust decision is made.