CVE-2024-38428
Fixed in a distro release EPSS <1%CVSS 9.1
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Products: gnu wget
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | wget | 1.19.5-12.el8_10 |
| AlmaLinux 9 | wget | 1.21.1-8.el9_4 |
| Amazon Linux 2023 | wget | 1.21.3-1.amzn2023.0.4 |
| Debian 11 | wget | 1.21-1+deb11u2 |
| Debian 12 | wget | 1.21.3-1+deb12u1 |
| Debian 13 | wget | 1.24.5-2 |
| Debian 14 | wget | 1.24.5-2 |
| Red Hat Enterprise Linux 8 | wget | 0:1.19.5-12.el8_10 |
| Red Hat Enterprise Linux 8 | wget-debuginfo | 0:1.19.5-12.el8_10 |
| Red Hat Enterprise Linux 8 | wget-debugsource | 0:1.19.5-12.el8_10 |
| Red Hat Enterprise Linux 9 | wget | 0:1.21.1-8.el9_4 |
| Red Hat Enterprise Linux 9 | wget-debuginfo | 0:1.21.1-8.el9_4 |
| Red Hat Enterprise Linux 9 | wget-debugsource | 0:1.21.1-8.el9_4 |
| Red Hat rhel aus 8.6 | wget | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel aus 8.6 | wget-debuginfo | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel aus 8.6 | wget-debugsource | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel e4s 8.6 | wget | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel e4s 8.6 | wget-debuginfo | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel e4s 8.6 | wget-debugsource | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel eus 8.8 | wget | 0:1.19.5-11.el8_8.1 |
| Red Hat rhel eus 8.8 | wget-debuginfo | 0:1.19.5-11.el8_8.1 |
| Red Hat rhel eus 8.8 | wget-debugsource | 0:1.19.5-11.el8_8.1 |
| Red Hat rhel eus 9.2 | wget | 0:1.21.1-7.el9_2.1 |
| Red Hat rhel eus 9.2 | wget-debuginfo | 0:1.21.1-7.el9_2.1 |
| Red Hat rhel eus 9.2 | wget-debugsource | 0:1.21.1-7.el9_2.1 |
| Red Hat rhel tus 8.6 | wget | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel tus 8.6 | wget-debuginfo | 0:1.19.5-10.el8_6.2 |
| Red Hat rhel tus 8.6 | wget-debugsource | 0:1.19.5-10.el8_6.2 |
| Rocky Linux 8 | wget | 0:1.19.5-12.el8_10 |
| Rocky Linux 9 | wget | 0:1.21.1-8.el9_4 |
| SUSE Linux Enterprise Micro 5.5 | wget | 1.20.3-150000.3.20.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP5 | wget | 1.20.3-150000.3.20.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | wget | 1.20.3-150600.19.3.1 |
| SUSE Linux Enterprise Server 12 SP5 | wget | 1.14-21.19.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | wget | 1.14-21.19.1 |
| SUSE Linux Micro 6.0 | wget | 1.24.5-1.1 |
| Ubuntu 20.04 LTS | wget | 1.20.3-1ubuntu2.1 |
| Ubuntu 22.04 LTS | wget | 1.21.2-2ubuntu1.1 |
| Ubuntu 22.04 LTS | wget | 1.21.2-2ubuntu1.3 |
| Ubuntu 24.04 LTS | wget | 1.21.4-1ubuntu4.3 |
| Ubuntu 24.04 LTS | wget | 1.21.4-1ubuntu4.1 |
| Ubuntu 26.04 LTS | wget | 1.25.0-2ubuntu4.2 |
| Ubuntu Pro 14.04 LTS | wget | 1.15-1ubuntu1.14.04.5+esm2 |
| Ubuntu Pro 16.04 LTS | wget | 1.17.1-1ubuntu1.5+esm1 |
| Ubuntu Pro 16.04 LTS | wget | 1.17.1-1ubuntu1.5+esm3 |
| Ubuntu Pro 18.04 LTS | wget | 1.19.4-1ubuntu2.2+esm3 |
| Ubuntu Pro 18.04 LTS | wget | 1.19.4-1ubuntu2.2+esm1 |
| Ubuntu Pro 20.04 LTS | wget | 1.20.3-1ubuntu2.1+esm2 |
| openSUSE Leap 15.5 | wget | 1.20.3-150000.3.20.1 |
| openSUSE Leap 15.6 | wget | 1.20.3-150600.19.3.1 |
| openSUSE Tumbleweed | wget | 1.24.5-2.1 |