CVE-2024-10524

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.(CVE-2024-10524)

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.

Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host. (CVE-2024-10524)

These are all security issues fixed in the wget-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed.

Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.18. Multiple fixed versions available.

Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.19. Multiple fixed versions available.

Root has patched CVE-2024-10524 in the rootio-wget package for Root:Alpine:3.20. Multiple fixed versions available.

Root has patched CVE-2024-10524 in the wget package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2024-10524 in the wget package for Root:Debian:12. Multiple fixed versions available.

This update for wget fixes the following issues:

• CVE-2024-10524: Fixed SSRF via shorthand HTTP URL (bsc#1233773)

This update for wget fixes the following issues:

• CVE-2024-10524: Fixed SSRF via shorthand HTTP URL (bsc#1233773)

This update for wget fixes the following issues:

• CVE-2024-10524: Dropped support for shorthand URLs that enabled SSRF attacks (bsc#1233773).

This update for wget fixes the following issues:

• CVE-2024-10524: Drop support for shorthand URLs (bsc#1233773).

This update for wget fixes the following issues:

• CVE-2024-10524: Drop support for shorthand URLs (bsc#1233773).

This update for wget fixes the following issues:

• CVE-2026-15146: unvalidated IP address in an FTP PASV response can lead to server-side request forgery (bsc#1271320).
• CVE-2026-58469: Metalink document containing a whitespace-only URL can cause a heap buffer underread (bsc#1271033).
• CVE-2026-58470: server-controlled values can cause an integer overflow in parse_content_range() (bsc#1271034).
• CVE-2026-58471: server-supplied filenames requiring character set conversion could lead to heap memory corruption (bsc#1271035).
• CVE-2026-58472: crafted HTML attribute with a large number of characters can lead to a heap buffer overflow (bsc#1271036).