CVE-2024-10524
Publication date 19 November 2024
Last updated 20 November 2024
Ubuntu priority
Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these cases attackers can enter crafted credentials which will cause Wget to access an arbitrary host.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| wget | 24.10 oracular |
Needs evaluation
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| 14.04 LTS trusty | Ignored end of ESM support, was needs-triage |
Notes
mdeslaur
the upstream fix removes shorthand support for URLs. Fixing this will change behaviour and may break existing uses of wget.
Patch details
| Package | Patch details |
|---|---|
| wget |