Critical Vulnerability in Wget Package: Chunk Length Handling Flaw
Summary
ALPINE-CVE-2017-13089: The http.c:skip_short_body() function is called in some circumstances, such as when processing redirects. Affects wget versions < 1.18-r2. Fixed in 1.18-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wget is a widely used command-line utility for downloading files from the web. It supports HTTP, HTTPS, and FTP protocols, allowing users to retrieve content from various sources. Wget is known for its robustness and flexibility, making it a staple tool for developers and system administrators. However, it has been found to have a critical vulnerability that affects its ability to handle chunked responses, potentially exposing users to security risks.
Vulnerability Detail
The vulnerability arises from the http.c:skip_short_body() function, which is invoked during the processing of redirects. In versions of Wget prior to 1.19.2, when a response is sent in chunked transfer encoding, the chunk parser utilizes strtol() to read the length of each chunk without validating that the length is a non-negative number. This oversight allows an attacker to manipulate the chunk length, leading to a scenario where a negative length is passed to the connect.c:fd_read() function. Since fd_read() accepts an int argument, the high 32 bits of the negative length are discarded, resulting in an attacker-controlled length argument. This flaw can lead to various security issues, including denial of service or arbitrary code execution.
How To Fix
Minimum fixed version
1.18-r2
This is the first release that contains the fix.
sudo apk add --upgrade wgetTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using Wget for downloading files from untrusted sources until the package is updated. Additionally, consider using alternative tools that do not exhibit this vulnerability.
Conclusion
In summary, the vulnerability in the Wget package related to chunk length handling poses serious security risks. Users are advised to update to the latest patched versions to mitigate these risks. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in your software effectively.
See every vulnerability recorded for wget →
FAQ
The CVSS score of this vulnerability is 8.8, indicating a critical level of severity.
Wget versions prior to 1.19.2 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The vulnerability can lead to denial of service or arbitrary code execution, posing significant risks to users and systems.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for wget.
