RHSA-2014:0151: Low: wget security and bug fix update

First published: Mon Feb 10 2014(Updated: )

The wget package provides the GNU Wget file retrieval utility for HTTP,<br>HTTPS, and FTP protocols. Wget provides various useful features, such as<br>the ability to work in the background while the user is logged out,<br>recursive retrieval of directories, file name wildcard matching or updating<br>files in dependency on file timestamp comparison.<br>It was discovered that wget used a file name provided by the server when<br>saving a downloaded file. This could cause wget to create a file with a<br>different name than expected, possibly allowing the server to execute<br>arbitrary code on the client. (CVE-2010-2252)<br>Note: With this update, wget always uses the last component of the original<br>URL as the name for the downloaded file. Previous behavior of using the<br>server provided name or the last component of the redirected URL when<br>creating files can be re-enabled by using the '--trust-server-names'<br>command line option, or by setting 'trust_server_names=on' in the wget<br>start-up file.<br>This update also fixes the following bugs:<br><li> Prior to this update, the wget package did not recognize HTTPS SSL</li> certificates with alternative names (subjectAltName) specified in the<br>certificate as valid. As a consequence, running the wget command failed<br>with a certificate error. This update fixes wget to recognize such<br>certificates as valid. (BZ#1060113)<br>All users of wget are advised to upgrade to this updated package, which<br>contain backported patches to correct these issues.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2014:0151
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat