1"use strict";(self.webpackChunkspectro_cloud_docs=self.webpackChunkspectro_cloud_docs||[]).push([["10540"],{18858:function(e,t,i){i.r(t),i.d(t,{frontMatter:()=>l,toc:()=>d,default:()=>u,metadata:()=>s,assets:()=>a,contentTitle:()=>c});var s=JSON.parse('{"id":"security-bulletins/reports/pc-cve-2024-38428","title":"CVE-2024-38428","description":"Lifecycle of CVE-2024-38428","source":"@site/docs/docs-content/security-bulletins/reports/pc-cve-2024-38428.md","sourceDirName":"security-bulletins/reports","slug":"/security-bulletins/reports/pc-cve-2024-38428","permalink":"/security-bulletins/reports/pc-cve-2024-38428","draft":false,"unlisted":false,"editUrl":"https://github.com/spectrocloud/librarium/blob/master/docs/docs-content/security-bulletins/reports/pc-cve-2024-38428.md","tags":[{"inline":true,"label":"security","permalink":"/tags/security"},{"inline":true,"label":"cve","permalink":"/tags/cve"}],"version":"current","lastUpdatedAt":null,"frontMatter":{"sidebar_label":"CVE-2024-38428","title":"CVE-2024-38428","description":"Lifecycle of CVE-2024-38428","sidebar_class_name":"hide-from-sidebar","hide_table_of_contents":false,"toc_max_heading_level":2,"tags":["security","cve"]},"sidebar":"docSidebar","previous":{"title":"CVE-2024-37371","permalink":"/security-bulletins/reports/pc-cve-2024-37371"},"next":{"title":"CVE-2024-40464","permalink":"/security-bulletins/reports/pc-cve-2024-40464"}}'),n=i(474848),r=i(884429);let l={sidebar_label:"CVE-2024-38428",title:"CVE-2024-38428",description:"Lifecycle of CVE-2024-38428",sidebar_class_name:"hide-from-sidebar",hide_table_of_contents:!1,toc_max_heading_level:2,tags:["security","cve"]},c,a={},d=[{value:"CVE Details",id:"cve-details",level:2},{value:"Initial Publication",id:"initial-publication",level:2},{value:"Last Update",id:"last-update",level:2},{value:"Third Party Dependency",id:"third-party-dependency",level:2},{value:"NIST CVE Summary",id:"nist-cve-summary",level:2},{value:"CVE Severity",id:"cve-severity",level:2},{value:"Our Official Summary",id:"our-official-summary",level:2},{value:"Status",id:"status",level:2},{value:"Affected Products & Versions",id:"affected-products--versions",level:2},{value:"Revision History",id:"revision-history",level:2}];function o(e){let t={a:"a",h2:"h2",p:"p",table:"table",tbody:"tbody",td:"td",th:"th",thead:"thead",tr:"tr",...(0,r.R)(),...e.components};return(0,n.jsxs)(n.Fragment,{children:[(0,n.jsx)(t.h2,{id:"cve-details",children:"CVE Details"}),"\n",(0,n.jsxs)(t.p,{children:["Visit the official vulnerability details page for ",(0,n.jsx)(t.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2024-38428",children:"CVE-2024-38428"})," to learn more."]}),"\n",(0,n.jsx)(t.h2,{id:"initial-publication",children:"Initial Publication"}),"\n",(0,n.jsx)(t.p,{children:"11/13/2024"}),"\n",(0,n.jsx)(t.h2,{id:"last-update",children:"Last Update"}),"\n",(0,n.jsx)(t.p,{children:"12/12/2024"}),"\n",(0,n.jsx)(t.h2,{id:"third-party-dependency",children:"Third Party Dependency"}),"\n",(0,n.jsx)(t.p,{children:"wget"}),"\n",(0,n.jsx)(t.h2,{id:"nist-cve-summary",children:"NIST CVE Summary"}),"\n",(0,n.jsx)(t.p,{children:"url.c in GNU Wget through 1.24.5 mishandles semicolons in the userinfo subcomponent of a URI, and thus there may be insecure behavior in which data that was supposed to be in the userinfo subcomponent is misinterpreted to be part of the host subcomponent."}),"\n",(0,n.jsx)(t.h2,{id:"cve-severity",children:"CVE Severity"}),"\n",(0,n.jsx)(t.p,{children:(0,n.jsx)(t.a,{href:"https://nvd.nist.gov/vuln/detail/cve-2024-38428",children:"9.1"})}),"\n",(0,n.jsx)(t.h2,{id:"our-official-summary",children:"Our Official Summary"}),"\n",(0,n.jsx)(t.p,{children:"This is a critical severity vulnerability that affects any Wget version up to and including 1.24.5. `wget` parses URIs\nin a way that causes user information to be considered part of the host if it contains a semicolon. This means that the\nhost part of the URI could be interpreted incorrectly and be abused by attackers that control the userinfo. The CVE is\nonly exploitable when a vulnerable `wget` version is used in specific conditions. Risk of this vulnerability getting\nexploited in Spectro Cloud products is low. Need updates from the 3rd party vendor to fix the vulnerability."}),"\n",(0,n.jsx)(t.h2,{id:"status",children:"Status"}),"\n",(0,n.jsx)(t.p,{children:"Ongoing"}),"\n",(0,n.jsx)(t.h2,{id:"affected-products--versions",children:"Affected Products & Versions"}),"\n",(0,n.jsxs)(t.table,{children:[(0,n.jsx)(t.thead,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.th,{children:"Version"}),(0,n.jsx)(t.th,{children:"Palette Enterprise"}),(0,n.jsx)(t.th,{children:"Palette Enterprise Airgap"}),(0,n.jsx)(t.th,{children:"VerteX"}),(0,n.jsx)(t.th,{children:"VerteX Airgap"})]})}),(0,n.jsx)(t.tbody,{children:(0,n.jsxs)(t.tr,{children:[(0,n.jsx)(t.td,{children:"4.4.20"}),(0,n.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,n.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,n.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"}),(0,n.jsx)(t.td,{children:"\u26A0\uFE0F Impacted"})]})})]}),"\n",(0,n.jsx)(t.h2,{id:"revision-history",children:"Revision History"}),"\n",(0,n.jsx)(t.p,{children:"No revisions available."})]})}function u(e={}){let{wrapper:t}={...(0,r.R)(),...e.components};return t?(0,n.jsx)(t,{...e,children:(0,n.jsx)(o,{...e})}):o(e)}},884429:function(e,t,i){i.d(t,{R:()=>l,x:()=>c});var s=i(296540);let n={},r=s.createContext(n);function l(e){let t=s.useContext(r);return s.useMemo(function(){return"function"==typeof e?e(t):{...t,...e}},[t,e])}function c(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(n):e.components||n:l(e.components),s.createElement(r.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.