[ GLSA 201903-08 ] GNU Wget

[GLSA]

Gentoo Linux Security Advisory

Title: GNU Wget: Password and metadata leak (GLSA 201903-08)
Severity: normal
Exploitable: local
Date: 2019-03-10
Bug(s): #674170
ID: 201903-08

Synopsis

A vulnerability in GNU Wget which could allow an attacker to obtain
sensitive information.


Background

GNU Wget is a free software package for retrieving files using HTTP,
HTTPS and FTP, the most widely-used Internet protocols.


Affected Packages

Package: net-misc/wget
Vulnerable: < 1.20.1
Unaffected: >= 1.20.1
Architectures: All supported architectures


Description

A vulnerability was discovered in GNU Wget’s file_metadata in xattr.c.

Impact

A local attacker could obtain sensitive information to include
credentials.


Workaround

There is no known workaround at this time.

Resolution

All GNU Wget users should upgrade to the latest version: