CVE-2024-38428

2024-06-1600:00:00

ubuntu.com

gnu wget userinfo mishandling

cve-2024-38428

uri semicolon mishandle

insecure behavior

host subcomponent misinterpretation

debian bug 1073523

unix

6.4 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo
subcomponent of a URI, and thus there may be insecure behavior in which
data that was supposed to be in the userinfo subcomponent is misinterpreted
to be part of the host subcomponent.

Bugs

<http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1073523>

Notes

Author	Note
mdeslaur	using semicolons in the userinfo component isn’t a common occurence, but a user could be tricked into thinking they are connecting to a different host than they are in actuality

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchwget< 1.19.4-1ubuntu2.2+esm1UNKNOWN
ubuntu20.04noarchwget< 1.20.3-1ubuntu2.1UNKNOWN
ubuntu22.04noarchwget< 1.21.2-2ubuntu1.1UNKNOWN
ubuntu23.10noarchwget< 1.21.3-1ubuntu1.1UNKNOWN
ubuntu24.04noarchwget< 1.21.4-1ubuntu4.1UNKNOWN
ubuntu14.04noarchwget< anyUNKNOWN
ubuntu16.04noarchwget< 1.17.1-1ubuntu1.5+esm1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	wget	< 1.19.4-1ubuntu2.2+esm1	UNKNOWN
ubuntu	20.04	noarch	wget	< 1.20.3-1ubuntu2.1	UNKNOWN
ubuntu	22.04	noarch	wget	< 1.21.2-2ubuntu1.1	UNKNOWN
ubuntu	23.10	noarch	wget	< 1.21.3-1ubuntu1.1	UNKNOWN
ubuntu	24.04	noarch	wget	< 1.21.4-1ubuntu4.1	UNKNOWN
ubuntu	14.04	noarch	wget	< any	UNKNOWN
ubuntu	16.04	noarch	wget	< 1.17.1-1ubuntu1.5+esm1	UNKNOWN