CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

GNU Wget is a free software package for retrieving files using HTTP, HTTPS, FTP and FTPS the most widely-used Internet protocols. It is a non-interactive commandline tool, so it may easily be called from scripts, cron jobs, terminals without X-Windows support, etc.

Security Fix(es):

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.(CVE-2024-38428)

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es):

• wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es):

• wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Root has patched CVE-2024-38428 in the wget package for Root:Debian:12. Multiple fixed versions available.

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es):

• wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

Security Fix(es):

• wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• SECURITY UPDATE: Insecure behavior with semicolons in URI userinfo
  • debian/patches/CVE-2024-38428.patch: Properly re-implement userinfo parsing (rfc2396) to fix outdated RFC implementation
  • CVE-2024-38428

• SECURITY UPDATE: Insecure behavior with semicolons in URI userinfo
  • debian/patches/CVE-2024-38428.patch: Properly re-implement userinfo parsing (rfc2396) to fix outdated RFC implementation
  • CVE-2024-38428

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)
• Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing
• Providing wget -O and -q parameters while running in background generates a wget-log file

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)
• Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing
• Providing wget -O and -q parameters while running in background generates a wget-log file

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)
• Fix wget Test-proxied-https-auth.px and Test-proxied-https-auth.px tests failing
• Providing wget -O and -q parameters while running in background generates a wget-log file

• CVE-2024-38428: properly re-implement userinfo parsing

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)

• CVE-2024-38428: properly re-implement userinfo parsing (rfc2396)

• CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to prevent insecure behavior

• CVE-2024-38428: fix mishandle semicolons in userinfo subcomponent of URI to prevent insecure behavior

• SECURITY UPDATE: mishandling of semicolons in userinfo
  • debian/patches/CVE-2024-38428.patch: properly re-implement userinfo parsing in src/url.c.
  • CVE-2024-38428

url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent. (CVE-2024-38428)

These are all security issues fixed in the wget-1.24.5-2.1 package on the GA media of openSUSE Tumbleweed.

This update for wget fixes the following issues:

• CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

This update for wget fixes the following issues:

• CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

This update for wget fixes the following issues:

• CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

This update for wget fixes the following issues:

• CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

This update for wget fixes the following issues:

• CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

• Update to GNU wget 1.24.5:

  • Fix how subdomain matches are checked for HSTS.
  • Wget will now also parse the srcset attribute in <source> HTML tags
  • Support reading fetchmail style "user" and "passwd" fields from netrc
  • In some cases, prevent the confusing "Cannot write to... (success)" error messages
  • Support extremely fast download speeds (TB/s)
  • Ensure that CSS URLs are corectly quoted
  • libproxy support is now upstream- drop wget-libproxy.patch

It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected.

USN-6852-1 fixed a vulnerability in Wget. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS.

Original advisory details:

It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected.

It was discovered that Wget mishandled semicolons in the userinfo subcomponent of a URL. A remote attacker could possibly use this issue to trick a user into connecting to a different host than intended. This issue only affected Ubuntu 14.04 LTS. (CVE-2024-38428)

It was discovered that Wget incorrectly handled Metalink documents containing a whitespace-only URL. A remote attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58469)

It was discovered that Wget incorrectly handled Content-Range header values, leading to an integer overflow. A remote attacker could possibly use this issue to cause download desynchronization. (CVE-2026-58470)

It was discovered that Wget incorrectly handled character set conversion of server-supplied filenames. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-58471)

It was discovered that Wget incorrectly handled HTML attributes requiring entity encoding. A remote attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2026-58472)