Input validation error in wget - CVE-2024-10524

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU100247

Input validation error in wget - CVE-2024-10524

Published: November 12, 2024


Vulnerability identifier: #VU100247
CSH Severity: Medium
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-10524
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an unspecified error in wget. A remote attacker can trick the victim into connecting to a specially crafted website and bypass certain security restrictions.


Affected software

wget
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Micro
Slackware Linux
Basesystem Module
openSUSE Leap
openEuler
Anolis OS
Oracle Solaris
SmartFabric Manager
Rapid Infrastructure Automation
wget-debugsource
wget-debuginfo
wget
wget-lang
wget-help
wget-doc

How to mitigate CVE-2024-10524

Install updates from vendor's website.

wget - update to 1.25.0
SmartFabric Manager - update to 1.2.0
Rapid Infrastructure Automation - update to 1.1.5.3
wget-debugsource - addressed in versions 1.14-21.25.1, 1.20.3-150000.3.26.1, 1.20.3-150600.19.9.1
wget-debuginfo - addressed in versions 1.14-21.25.1, 1.20.3-150000.3.26.1, 1.20.3-150600.19.9.1
wget - addressed in versions 1.14-21.25.1, 1.20.3-150000.3.26.1, 1.20.3-150600.19.9.1
wget-lang - addressed in versions 1.20.3-150000.3.26.1, 1.20.3-150600.19.9.1
wget - update to 1.21.2-6
wget-debuginfo - update to 1.21.2-6
wget-debugsource - update to 1.21.2-6
wget-help - update to 1.21.2-6
wget - update to 1.21.4-4
wget-doc - update to 1.21.4-4
wget - update to 1.25.0
Oracle Solaris - update to 11.4 SRU 77

External References

Related Security Bulletins