Canonical Ubuntu, wget
Canonical Ubuntu 14.04 LTS
Dawid Golunski discovered that Wget incorrectly handled filenames when being redirected from an HTTP to an FTP URL. A malicious server could possibly use this issue to overwrite local files.
Affected Products and Versions
Severity is medium unless otherwise noted.
- Cloud Foundry cflinuxfs2 versions prior to 1.67.0
- Cloud Foundry BOSH stemcells 3146.x versions prior to 3146.17 AND other versions prior to 3232.12 are vulnerable
Users of affected versions should apply the following mitigation:
- Upgrade to Cloud Foundry cflinuxfs2 versions 1.67.0 or later
- The Cloud Foundry team has released patched BOSH stemcells 3146.17 and 3232.12 with an upgraded Linux kernel that resolves the aforementioned issues. We recommend that Operators upgrade BOSH stemcell 3146.x versions to 3146.17 OR other versions to 3232.12