CVE-2024-38428

2024-06-1603:15:08

Debian Security Bug Tracker

security-tracker.debian.org

gnu wget

cve-2024-38428

uri

userinfo subcomponent

host subcomponent

insecure behavior

6.9 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

OSVersionArchitecturePackageVersionFilename
Debian12allwget<= 1.21.3-1wget_1.21.3-1_all.deb
Debian11allwget<= 1.21-1+deb11u1wget_1.21-1+deb11u1_all.deb
Debian10allwget<= 1.20.1-1.1wget_1.20.1-1.1_all.deb
Debian999allwget<= 1.24.5-1wget_1.24.5-1_all.deb
Debian13allwget<= 1.24.5-1wget_1.24.5-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	wget	<= 1.21.3-1	wget_1.21.3-1_all.deb
Debian	11	all	wget	<= 1.21-1+deb11u1	wget_1.21-1+deb11u1_all.deb
Debian	10	all	wget	<= 1.20.1-1.1	wget_1.20.1-1.1_all.deb
Debian	999	all	wget	<= 1.24.5-1	wget_1.24.5-1_all.deb
Debian	13	all	wget	<= 1.24.5-1	wget_1.24.5-1_all.deb