![\"\"](\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2023\/11\/Apple-software-update-red-critical-urgent-this-is-fine-bg-600x300-1.jpg\")
<\/p>\n<\/p>\n
On October 25, 2023, Apple released macOS Sonoma 14.1, which included security updates<\/a>.<\/p>\n About two weeks later, on November 7, Apple released macOS Sonoma 14.1.1, a minor update with no listed security patches.<\/p>\n Oddly, both of these updates were apparently missing a patch for a critical vulnerability<\/strong> that made headlines one month ago. A popular command-line utility, curl, and its associated library, libcurl, had two newly discovered vulnerabilities. One of them (CVE-2023-38545) had a CVSS “9.8 CRITICAL” score out of a maximum 10. The curl project maintainers patched both vulnerabilities on October 11.<\/p>\n Upon further investigation, we found that macOS Sonoma appears to contain several other vulnerabilities.<\/strong> In this article, we’ll take a look at several known vulnerabilities that apparently remain unpatched in the latest version, macOS Sonoma 14.4.<\/p>\n Update: Apple still has not addressed the critical LibreSSL vulnerabilities as of macOS Sonoma 14.4.<\/em><\/strong> We originally published this article on November 10, after Apple released macOS Sonoma 14.1.1. On December 14, we updated this article to note that Apple silently included curl 8.4.0 in the macOS Sonoma 14.2 update, and to note that the rest of the vulnerabilities apparently remain unpatched. On January 26, we updated this article again to note that macOS Sonoma 14.3 finally includes a version of nghttp2 that patches the known vulnerability. And on March 8, we noted that macOS Sonoma 14.4 still hasn’t patched LibreSSL.<\/p>\n In this article:<\/em><\/p>\n I verified by running the The current version of curl is 8.4.0<\/a>, but the version included with macOS Sonoma 14.1.1 is 8.1.2. That curl version is from May 30, 2023 (as noted in the “Release-Date:” portion of the command output above). In the six months since then, curl updates have included patches for a total of three vulnerabilities with CVEs:<\/p>\n Apple makes no mention of these vulnerabilities on its site. There is also no mention of curl in macOS Sonoma 14.1’s security release notes<\/a>; meanwhile, Apple did not even issue security release notes for macOS Sonoma 14.1.1, instead stating<\/a> that “This update has no published CVE entries.”<\/p>\n Update: Apple silently addressed the curl vulnerabilities in macOS Sonoma 14.2.<\/strong> Specifically, Apple now includes curl 8.4.0 with the OS as of the December 11 update. (For some reason, Apple didn’t upgrade to curl 8.5.0, released on December 6. Version 8.5.0 does not address any CVEs, but includes several SSL-related patches.) Apple did not mention its move to curl 8.4.0 anywhere on its site. Likewise, Apple did not mention the CVEs in the update’s security release notes.<\/p>\n But that’s not the end of the story.<\/em><\/strong><\/a><\/p>\n If we take a closer look at the command output above, we can see curl’s dependencies. Aside from curl’s own libcurl, the app relies upon other open-source software: LibreSSL, zlib, and nghttp2.<\/p>\n <\/a>None of those libraries is up to date. In fact, nearly all of them may be vulnerable<\/strong>, as I’ll detail below.<\/p>\n The current version of LibreSSL is 3.8.2<\/a>, released November 2, 2023. The version included with macOS Sonoma is 3.3.6, released March 15, 2022\u2014about two years ago<\/strong>.<\/p>\n According to NIST’s National Vulnerability Database, this version of LibreSSL contains at least four known vulnerabilities<\/a>:<\/p>\n <\/a>Apple makes no mention of these vulnerabilities on its site.<\/p>\n The current version of zlib is 1.3<\/a>, released August 18. The zlib version included with macOS Sonoma is 1.2.12, released March 27, 2022\u2014again, about two years ago:<\/p>\n Since then, a zlib update included a patch for a critical “9.8 out of 10” severity vulnerability:<\/p>\n Interestingly, Apple says<\/a> that it addressed this vulnerability “with improved checks” in the first release of macOS Ventura 13, a little over a year ago. <\/a>If true, it’s strange that Apple would apparently leave the old version in place; newer versions contain other bug fixes, too, not just the security fix.<\/p>\n The current version of nghttp2 is 1.59.0<\/a>, released January 21, 2024. The version included with curl in macOS Sonoma 14.2 is 1.55.1, released July 14, 2023. Since then, an nghttp2 update patched a “7.5 out of 10” high-severity vulnerability that has been actively exploited in the wild<\/strong>:<\/p>\n Apple makes no mention of this vulnerability on its site.<\/p>\n Update: Apple silently addressed the nghttp2 vulnerability in macOS Sonoma 14.3<\/strong> on January 22, 2024, by upgrading to 1.58.0. Although it’s not actually the latest version, it does at least fix the known vulnerability. Apple did not mention its move to nghttp2 1.58.0 anywhere on its site. Likewise, Apple did not mention the CVE in the update’s security release notes.<\/a><\/p>\n Notably, this isn’t the first time that Apple has neglected to patch open-source software quickly in its operating systems.<\/p>\n One well-documented public example of this was Apple’s inclusion of Python 2.7 with macOS for nearly two years after its final update<\/a>. But Apple doesn’t always get media coverage for such occurrences. Rather, outdated open-source software in macOS often goes unnoticed, except amongst the handful of security researchers who pay close attention to such things.<\/p>\n We reached out to Apple for comment. Apple has not responded to our inquiry.<\/a><\/p>\n Unfortunately, when Apple chooses not to patch known vulnerabilities quickly, it leaves end users exposed.<\/p>\n Although there is little that Mac users can do, there is one important thing. You can help put pressure on Apple by raising awareness of reports like this one.<\/p>\n We encourage responsible media outlets to report on issues of public concern like this, to encourage Apple to not take a lax approach to security issues.<\/a><\/p>\n We first discussed the missing curl patch on the October 12 episode<\/a> of the Intego Mac Podcast:<\/p>\n\n
\n
curl in macOS Sonoma 14.1.1 was vulnerable (patched in 14.2)<\/h3>\n
curl --version<\/code> command that, indeed, macOS Sonoma 14.1.1 still appears to have a vulnerable version of curl:<\/p>\n% curl --version \r\ncurl 8.1.2 (x86_64-apple-darwin23.0) libcurl\/8.1.2 (SecureTransport) LibreSSL\/3.3.6 zlib\/1.2.12 nghttp2\/1.55.1\r\nRelease-Date: 2023-05-30<\/pre>\n
\n
More outdated and vulnerable libraries in macOS Sonoma 14.4<\/h3>\n
LibreSSL remains outdated and vulnerable<\/strong><\/h4>\n
% openssl version \r\nLibreSSL 3.3.6<\/pre>\n
\n
zlib remains outdated and may be vulnerable<\/strong><\/h4>\n
% python3 -c \"import zlib; print(zlib.ZLIB_RUNTIME_VERSION)\" \r\n1.2.12<\/pre>\n
\n
nghttp2 was outdated and vulnerable (patched in 14.3)<\/strong><\/h4>\n
\n
Why is Apple negligent in patching open-source software?<\/h3>\n
What can users do about this?<\/h3>\n
How can I learn more?<\/h3>\n