USN-6852-2: Wget vulnerability
24761
22 August 2024
22 August 2024
CLOSED
MEDIUM
CVE-2024-38428
Severity
medium
Vendor
VMware Tanzu
Versions Affected
- Canonical Ubuntu 18.04
- Canonical Ubuntu 16.04
- Cflinuxfs3
- Xenial Stemcell 621.x
- Operations Manager Image 2.10.x
Description
USN-6852-1 fixed a vulnerability in Wget. This update provides the corresponding update for Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Original advisory details: It was discovered that Wget incorrectly handled semicolons in the userinfo subcomponent of a URI. A remote attacker could possibly trick a user into connecting to a different host than expected. Update Instructions: Run `sudo pro fix USN-6852-2` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: wget - 1.17.1-1ubuntu1.5+esm1 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
Fixed VMware Products and Versions
- Cflinuxfs3
- 0.390.0 or greater
- Tanzu Greenplum for Kubernetes
- 2.0.0 or greater
- Cf Deployment
- 30.0.0 or greater
References
https://ubuntu.com/security/notices/USN-6852-2
https://www.cloudfoundry.org/blog/usn-6852-2
https://cve.mitre.org/cgi-bin/cvename.cgi?name=usn-6852-2
History
2024-06-27: Initial vulnerability report published.