Loading vulnerability…
URI Userinfo Parsing Confusion in GNU Wget
CVE-2024-38428 is a URI parsing vulnerability in GNU Wget through version 1.24.5. Incorrect handling of semicolons in the userinfo subcomponent can cause data intended as user information to be interpreted as part of the host subcomponent. A crafted URI can consequently cause Wget to connect to a different host than expected, potentially exposing information or undermining destination-based security controls.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker may redirect an affected Wget client's connection to an unintended host, potentially causing information disclosure and compromising the integrity of retrieved content. The consequences depend on how the invoking application validates destinations and uses downloaded data. The supplied CVSS v3.0 assessment assigns high confidentiality and integrity impact and no availability impact; arbitrary code execution is not established.
If you can’t patch tonight, do this now.
No vulnerability-specific vendor workaround is documented. As interim risk reduction, avoid passing untrusted URIs to affected Wget installations, reject unnecessary URI userinfo components—particularly those containing semicolons—and restrict outbound connections to approved destinations. These measures do not replace installing the fix.
Patch, then assume compromise.
Install vendor-patched Wget packages or updated product images that address CVE-2024-38428. Identified fixed releases include Ubuntu wget 1.17.1-1ubuntu1.5+esm1, Google Container-Optimized OS 18244.85.54, Cflinuxfs3 0.390.0, Tanzu Greenplum for Kubernetes 2.0.0, and CF Deployment 30.0.0, or later applicable releases. Red Hat OpenShift Data Foundation 4.14.11 and 4.16.2 also include fixes. Use the applicable vendor advisory to select the correct package or image for each deployment, since distribution fixes may be backported.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.