Asuswrt-Merlin is NOT affected by CVE-2023-38545

[RMerlin]

In before the flood of "OMG we need a firmware update!":

Asuswrt-Merlin's curl is compiled without proxy support, and therefore is not affected by the recent CVE-2023-38545 security issue.

 

[johndoe85]

But... we want an firmware upgrade nevertheless :F I mean, who doesn't like a firmware upgrade?

 

[Yota]

In my opinion, even if there is a vulnerability in curl, I think it will not affect Asuswrt-Merlin to a large extent, because only user-defined scripts will use curl, and most users may not run any scripts.

 

[shabbs]

Whew - we are still on RHEL8 at work. Saw this thread and started to panic that we'd be working all weekend patching app servers.

 

[AntonK]

But... we want an firmware upgrade nevertheless :F I mean, who doesn't like a firmware upgrade?

Yes, we live for firmware updates. I'm sure many of you have noticed, as I have, that the interactions on this board become increasingly tense and strident the longer we go without one.

 

[John Fitzgerald]

increasingly tense and strident the longer we go without one.

WHAT! How dare you!

 

[RAH-66]

God bless @RMerlin !

p.s. We are all not eternal, are you already wondering who you will transfer your community to? Who are your Padawans?

 

[Tech9]

I'm sure many of you have noticed

If there is no more Asuswrt-Merlin - SNB Forums is dead within a year. The website is dead already.

 

[ika]

A little bit offtopic: About the website, yea, I don't know what could be the first step to turn it around, but the community is doing quite well in my opinion.
I'm just amazed how active it is after so many years. The web wouldn't be the same without it.

 

[RMerlin]

We are all not eternal, are you already wondering who you will transfer your community to? Who are your Padawans?

Nobody has the skill and the interest, or otherwise they would already been contributing to the project. The project will most likely die once I stop working on it.

 

[RMerlin]

About the website, yea, I don't know what could be the first step to turn it around

@thiggins no longer owns the website, he sold it to another party a few years ago. He currently only owns the forums.

 

[ika]

@thiggins no longer owns the website, he sold it to another party a few years ago. He currently only owns the forums.

Thank you for the info.

Nobody has the skill and the interest, or otherwise they would already been contributing to the project. The project will most likely die once I stop working on it.

Looking at the contributions, I believe the required skill is something the community could provide (perhaps not as high level as yours, but one must start from somewhere), but do you think Asus would trust them like how they trust you?