Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” in User-Agent

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by anyfoo on Wednesday March 27, 2019 @10:14PM (#19508529)

> Manager: And we can just prevent it with an extra regex rule in the front end code? > Engineer Alice: ... Yes. irrepressibly existential sigh

The answer is "no", though. This exchange sounds like the decision was between "fixing it cleanly" and "fixing it with a hack", which is roughly equivalent with fixing the problem at the expense of technical debt. But this change does not fix the problem at all.

[ Parent | on HN ]

Re:Cisco Fixes RV320/RV325 Vulnerability by Banning “curl” i... by fosco on Thursday March 28, 2019 @08:34AM (#19511523)

I have to agree that the answer is no.

curl -A "anything but Curl" x.x.x.x

the problem has not been fixed by a user agent string.

[ Parent | on HN ]