critique
CVE-2024-38428
wget: Misinterpretation of input may lead to improper behavior
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
NVD9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Red Hat5.5CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Julia9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon NVD, CBL-Mariner, Julia, Photon OS. Plus basse selon Red Hat (moyenne), AlmaLinux (moyenne), Amazon (moyenne), Oracle (moyenne), Rocky Linux (moyenne), Ubuntu (moyenne).
Description
url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| CBL-Mariner 2.0 | wget | 0:1.21.2-3.cm2 |
| julia::Julia Ecosystem Security Advisories | wget_jll | 1.25.0+0 |
| Photon OS 3.0 | wget | 1.21.3-2.ph3 |
| Photon OS 4.0 | wget | 1.21.3-2.ph4 |
| Photon OS 5.0 | wget | 1.21.3-5.ph5 |
| alma 8 | wget | 1.19.5-12.el8_10 |
| alma 9 | wget | 1.21.1-8.el9_4 |
| amazon linux 2023 | wget, wget-debuginfo, wget-debugsource | 1.21.3-1.amzn2023.0.4 |
| debian 10 | wget | pas de correctif indiqué |
| debian 11 | wget | 1.21-1+deb11u2 |
| debian 12 | wget | 1.21.3-1+deb12u1 |
| debian 13 | wget | 1.24.5-2 |
Afficher les 46 entrées de 40 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| CBL-Mariner 2.0 | wget | 0:1.21.2-3.cm2 |
| julia::Julia Ecosystem Security Advisories | wget_jll | 1.25.0+0 |
| Photon OS 3.0 | wget | 1.21.3-2.ph3 |
| Photon OS 4.0 | wget | 1.21.3-2.ph4 |
| Photon OS 5.0 | wget | 1.21.3-5.ph5 |
| alma 8 | wget | 1.19.5-12.el8_10 |
| alma 9 | wget | 1.21.1-8.el9_4 |
| amazon linux 2023 | wget | 1.21.3-1.amzn2023.0.4 |
| amazon linux 2023 | wget-debuginfo | 1.21.3-1.amzn2023.0.4 |
| amazon linux 2023 | wget-debugsource | 1.21.3-1.amzn2023.0.4 |
| debian 10 | wget | pas de correctif indiqué |
| debian 11 | wget | 1.21-1+deb11u2 |
| debian 12 | wget | 1.21.3-1+deb12u1 |
| debian 13 | wget | 1.24.5-2 |
| debian 14 | wget | 1.24.5-2 |
| echo | wget | 1.21.3-1+deb12u1 |
| Oracle Linux 8 | wget | 1.19.5-12.0.1.el8_10 |
| Oracle Linux 9 | wget | 1.21.1-8.el9_4 |
| rapidfort amazon linux 2023 | wget | 1.21.3-1.amzn2023.0.4 |
| rapidfort Oracle Linux 9 | wget | 0:1.21.1-8.el9_4 |
| rapidfort ubuntu 20.04 | rf-wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| rapidfort ubuntu 20.04 | wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| rapidfort ubuntu 22.04 | rf-wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| rapidfort ubuntu 22.04 | wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| rapidfort ubuntu 24.04 | rf-wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| rapidfort ubuntu 24.04 | wget | 0:1.21.2-2ubuntu1.1, 0:1.21.4-1ubuntu4.1 |
| Red Hat | wget | pas de correctif indiqué |
| rocky 8 | wget | 1.19.5-12.el8_10 |
| rocky 9 | wget | 1.21.1-8.el9_4 |
| root.io debian 11 | rootio-wget | 1.21-1+deb11u2 |
| root.io debian 12 | rootio-wget | 1.21.3-1+deb12u1, 1.21.3-1+deb12u1.root.io.1, 1.21.3-1+deb12u1.root.io.2, 1.21.3-1+deb12u1.root.io.3 |
| root.io debian 12 | wget | 1.21.3-1+deb12u1, 1.21.3-1+deb12u1.root.io.1, 1.21.3-1+deb12u1.root.io.2, 1.21.3-1+deb12u1.root.io.3 |
| root.io debian 13 | rootio-wget | 1.24.5-2 |
| root.io ubuntu 22.04 | rootio-wget | 1.21.2-2ubuntu1.1 |
| root.io ubuntu 24.04 | rootio-wget | 1.21.4-1ubuntu4.1 |
| ubuntu 16.04-ESM | wget | 1.17.1-1ubuntu1.5+esm1 |
| ubuntu 18.04-ESM | wget | 1.19.4-1ubuntu2.2+esm1 |
| ubuntu 20.04 | wget | 1.20.3-1ubuntu2.1 |
| ubuntu 20.04-ESM | wget | 1.20.3-1ubuntu2.1 |
| ubuntu 22.04 | wget | 1.21.2-2ubuntu1.1 |
| ubuntu 23.10 | wget | 1.21.3-1ubuntu1.1 |
| ubuntu 24.04 | wget | 1.21.4-1ubuntu4.1 |
| ubuntu 24.10 | wget | 1.24.5-1ubuntu2 |
| ubuntu 25.04 | wget | 1.24.5-1ubuntu2 |
| ubuntu 25.10 | wget | 1.24.5-1ubuntu2 |
| ubuntu 26.04 | wget | 1.24.5-1ubuntu2 |
Références
- https://access.redhat.com/errata/RHSA-2024:6192
- https://access.redhat.com/security/cve/CVE-2024-38428
- https://bugzilla.redhat.com/2292836
- https://bugzilla.redhat.com/show_bug.cgi?id=2292836
- https://creativecommons.org/licenses/by/4.0/
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-38428
- https://errata.almalinux.org/9/ALSA-2024-6192.html
- https://errata.rockylinux.org/RLSA-2024:6192
Les 19 références
- https://git.savannah.gnu.org/cgit/wget.git/commit/?id=ed0c7c7e0e8f7298352646b2fd6e06a11e242ace
- https://linux.oracle.com/cve/CVE-2024-38428.html
- https://linux.oracle.com/errata/ELSA-2024-6192.html
- https://lists.debian.org/debian-lts-announce/2025/04/msg00029.html
- https://lists.gnu.org/archive/html/bug-wget/2024-06/msg00005.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-38428
- https://security.netapp.com/advisory/ntap-20241115-0005/
- https://ubuntu.com/security/notices/USN-6852-1
- https://ubuntu.com/security/notices/USN-6852-2
- https://ubuntu.com/security/notices/USN-8543-1
- https://www.cve.org/CVERecord?id=CVE-2024-38428