An update of the wget package has been released.

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dla-4133 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4133-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                          Adrian Bunk     April 21, 2025                                https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : wget     Version        : 1.21-1+deb11u2     CVE ID         : CVE-2024-38428     Debian Bug     : 1073523

    Mishandling of semicolons in the userinfo subcomponent of a URI has been     fixed in GNU Wget, a utility for retrieving files over HTTP, HTTPS, FTP     and FTPS.

    For Debian 11 bullseye, this problem has been fixed in version     1.21-1+deb11u2.

    We recommend that you upgrade your wget packages.

    For the detailed security status of wget please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/wget

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:6192 advisory.

    * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:5299 advisory.

    * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2024:0194 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2024-38428:
    url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus     there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is     misinterpreted to be part of the host subcomponent.

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_6192 advisory.

    * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-2024_5299 advisory.

    * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2024:2154-1 advisory.

    - CVE-2024-38428: Fix mishandled semicolons in the userinfo subcomponent of a URI. (bsc#1226419)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6852-1 advisory.

    It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote     attacker could possibly trick a user into connecting to a different host than expected.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-657 advisory.

    url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus     there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is     misinterpreted to be part of the host subcomponent. (CVE-2024-38428)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2024-5299 advisory.

    [1.19.5-12.0.1]
    - SSLv3 support dropped from openssl, v3 test certificates need to be replaced [Orabug: 29613455]

    [1.19.5-12]
    - Resolves: RHEL-43559 - Misinterpretation of input may lead to improper behavior

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6208 advisory.

    The wget packages provide the GNU Wget file retrieval utility for HTTP, HTTPS, and FTP protocols.

    Security Fix(es):

    * wget: Misinterpretation of input may lead to improper behavior (CVE-2024-38428)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.2 host has a package installed that is affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2024:1725898066 advisory.

  - url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus     there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is     misinterpreted to be part of the host subcomponent. (CVE-2024-38428)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
205399	Photon OS 3.0: Wget PHSA-2024-3.0-0779	Nessus	PhotonOS Local Security Checks	2024/8/13	2024/8/13	critical
234688	Debian dla-4133 : wget - security update	Nessus	Debian Local Security Checks	2025/4/21	2025/4/21	critical
235506	RockyLinux 9 : wget (RLSA-2024:6192)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	critical
235555	RockyLinux 8 : wget (RLSA-2024:5299)	Nessus	Rocky Linux Local Security Checks	2025/5/7	2025/5/7	critical
236361	Alibaba Cloud Linux 3 : 0194: wget (ALINUX3-SA-2024:0194)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	critical
356386	Rocky Linux 9 [CIQ] Security Update: wget / wget-debuginfo / wget-debugsource (crlsa-2024_6192)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
355604	Rocky Linux 8 [CIQ] Security Update: wget / wget-debuginfo / wget-debugsource (crlsa-2024_5299)	Nessus	Rocky Linux Local Security Checks	2026/10/1	2026/10/1	critical
200844	SUSE SLES12 Security Update : wget (SUSE-SU-2024:2154-1)	Nessus	SuSE Local Security Checks	2024/6/22	2024/8/9	critical
201043	Ubuntu 20.04 LTS / 22.04 LTS / 23.10 / 24.04 LTS : Wget vulnerability (USN-6852-1)	Nessus	Ubuntu Local Security Checks	2024/6/26	2024/8/27	critical
202919	Amazon Linux 2023 : wget (ALAS2023-2024-657)	Nessus	Amazon Linux Local Security Checks	2024/7/22	2024/12/11	critical
204807	Photon OS 4.0: Wget PHSA-2024-4.0-0659	Nessus	PhotonOS Local Security Checks	2024/7/27	2024/8/9	critical
205479	Oracle Linux 8 : wget (ELSA-2024-5299)	Nessus	Oracle Linux Local Security Checks	2024/8/13	2025/9/9	critical
206629	RHEL 8 : wget (RHSA-2024:6208)	Nessus	Red Hat Local Security Checks	2024/9/5	2024/11/7	critical
334026	Photon OS 5.0: Wget PHSA-2024-5.0-92-0331	Nessus	PhotonOS Local Security Checks	2026/8/10	2026/8/10	critical
361443	AlmaLinux 9.2 [TuxCare] Security Update: wget (ALMALINUX9.2:CLSA-2024:1725898066)	Nessus	Alma Linux Local Security Checks	2026/10/1	2026/10/1	critical

检测

插件搜索

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical