CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

References

Affected packages

Debian:11 / wget

Package

Name: wget
Purl: pkg:deb/debian/wget?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.21-1+deb11u2

Affected versions

1.*

1.21-1

1.21-1+deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / wget

Package

Name: wget
Purl: pkg:deb/debian/wget?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.21.3-1+deb12u1

Affected versions

1.*

1.21.3-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / wget

Package

Name: wget
Purl: pkg:deb/debian/wget?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.24.5-2

Affected versions

1.*

1.21.3-1

1.21.4-1

1.24.5-1

Ecosystem specific

{
    "urgency": "not yet assigned"
}