GNU wget up to 1.24.5 Semicolon url.c interpretation conflict

Summaryinfo

A vulnerability classified as problematic has been found in GNU wget up to 1.24.5. This affects an unknown part of the file url.c of the component Semicolon Handler. Performing a manipulation results in an unknown weakness. This vulnerability was named CVE-2024-38428. The attack may be initiated remotely. There is no available exploit. It is recommended to apply a patch to fix this issue.

Detailsinfo

A vulnerability, which was classified as problematic, was found in GNU wget up to 1.24.5. This affects some unknown processing of the file url.c of the component Semicolon Handler. CWE is classifying the issue as CWE-436. Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state. This is going to have an impact on integrity. The summary by CVE is:

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

It is possible to read the advisory at lists.gnu.org. This vulnerability is uniquely identified as CVE-2024-38428 since 06/16/2024. The exploitability is told to be difficult. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details of the vulnerability are known, but there is no available exploit.

The vulnerability scanner Nessus provides a plugin with the ID 209773 (EulerOS Virtualization 2.12.1 : wget (EulerOS-SA-2024-2762)), which helps to determine the existence of the flaw in a target environment.

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.savannah.gnu.org.

The vulnerability is also documented in the vulnerability database at Tenable (209773). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Automation Software

Vendor

• GNU

Name

• wget

Version

• 1.24.0
• 1.24.1
• 1.24.2
• 1.24.3
• 1.24.4
• 1.24.5

License

• open-source

Website

• Vendor: https://www.gnu.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion