CVE-2017-13089
High · 8.8CVSS
8.8
EPSS
79.9%
Published
Oct 27, 2017
CISA due date
—
The record
The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. When the response is sent chunked in wget before 1.19.2, the chunk parser uses strtol() to read each chunk's length, but doesn't check that the chunk length is a non-negative number. The code then tries to skip the chunk in pieces of 512 bytes by using the MIN() macro, but ends up passing the negative chunk length to connect.c:fd_read(). As fd_read() takes an int argument, the high 32 bits of the chunk length are discarded, leaving fd_read() with a completely attacker controlled length argument.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Alpine:v3.4 | wget | 0 | 1.18-r2 |
| Alpine:v3.5 | wget | 0 | 1.18-r3 |
| Debian:11 | wget | 0 | 1.19.2-1 |
| Debian:12 | wget | 0 | 1.19.2-1 |
| Debian:13 | wget | 0 | 1.19.2-1 |
| Debian:7 | wget | 0 | 1.13.4-3+deb7u5 |
| Debian:8 | wget | 0 | 1.16-1+deb8u4 |
| Debian:9 | wget | 0 | 1.18-5+deb9u1 |
| Mageia:5 | wget | 0 | 1.15-5.3.mga5 |
| Mageia:6 | wget | 0 | 1.19.2-1.mga6 |
| Red Hat:enterprise_linux:7::client | wget | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::client | wget-debuginfo | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::computenode | wget | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::computenode | wget-debuginfo | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::server | wget | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::server | wget-debuginfo | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::workstation | wget | 0 | 0:1.14-15.el7_4.1 |
| Red Hat:enterprise_linux:7::workstation | wget-debuginfo | 0 | 0:1.14-15.el7_4.1 |
| SUSE:Linux Enterprise Desktop 12 SP2 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Desktop 12 SP3 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server 12 SP1-LTSS | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server 12 SP2 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server 12 SP3 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server 12-LTSS | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP1 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP2 | wget | 0 | 1.14-21.3.1 |
| SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | wget | 0 | 1.14-21.3.1 |
| SUSE:OpenStack Cloud 6 | wget | 0 | 1.14-21.3.1 |
| Ubuntu:14.04:LTS | wget | 0 | 1.15-1ubuntu1.14.04.3 |
| Ubuntu:16.04:LTS | wget | 0 | 1.17.1-1ubuntu1.3 |
| openSUSE:Tumbleweed | wget | 0 | 1.21.1-2.2 |
Related vulnerabilities
- CVE-2017-13090 The retr.c:fd_read_body() function is called when processing OK responses. Also affects wget
- CVE-2016-4971 GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a… Also affects wget
- CVE-2024-10524 Applications that use Wget to access a remote resource using shorthand URLs and pass… Also affects wget
- CVE-2024-38428 url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a… Also affects wget
- CVE-2016-7098 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to… Also affects wget
- CVE-2014-4877 Absolute path traversal vulnerability in GNU Wget before 1.16, when recursion is enabled… Also affects wget
- CVE-2004-1488 wget 1.8.x and 1.9.x does not filter or quote control characters when displaying HTTP… Also affects wget
- CVE-2015-2059 The stringprep_utf8_to_ucs4 function in libin before 1.31, as used in jabberd2, allows… Also affects wget