The release of GNU Wget 1.25 has been announced, a program for automating file downloads using HTTP/HTTPS and FTP/FTPS protocols. The utility supports features such as resuming interrupted downloads, mirroring websites with filtering of downloaded data by patterns, transforming links within documents, setting Cookies, and updating only changed files. The project's code is written in C and is distributed under the GPLv3 license.
In the new version:
- The parsing of part of the URL containing username information (protocol://userinfo@host:port/path) has been rewritten. Previously, wget incorrectly handled the ';' character during userinfo parsing, leading to a vulnerability (CVE-2024-38428) as part of the userinfo data could be processed as a hostname. For example, the username 'attackerhost;' in the URL 'ftp://attackerhost;@host' caused a request to the host 'attackerhost' instead of 'host'.
- Support for abbreviated URL link formats for HTTP and FTP resources (without explicit protocol indication, e.g., 'wget username:password@myserver') has been discontinued, which was previously deprecated and led to vulnerability CVE-2024-10524. Details about the vulnerability have not yet been disclosed, but it appears to be one variant of the aforementioned issue CVE-2024-38428.
- Reading from files and standard input (stdin) has been switched to non-blocking mode. This change allows links to be gradually fed through the input stream using the command 'print_urls | wget -i-'. Previously, wget read the available data and immediately closed the file descriptor.
In addition, the release of the utility for retrieving and sending data over the network — curl 8.11.0 has been noted, offering the ability to flexibly form requests with parameters such as cookie, user_agent, referer, and any other headers. cURL supports HTTP, HTTPS, HTTP/2.0, HTTP/3, SMTP, IMAP, POP3, SSH, Telnet, FTP, LDAP, RTSP, RTMP, and other networking protocols. The project's code is distributed under the Curl license (a variant of the MIT license).
Among the changes in curl 8.11:
- A vulnerability (CVE-2024-9681) has been fixed, which allowed access to resources via the http:// protocol, despite the presence of HSTS (HTTP Strict Transport Security) rules mandating only HTTPS usage. The issue occurs when there is control over the subdomains of the targeted host. For instance, when requesting the host x.example.com, an attacker can manipulate the HTTP header "Strict-Transport-Security:" to affect the HSTS caching data for domain example.com.
- Stable support for the WebSocket protocol has been announced.
- The ability to use the "—create-dirs" mode along with the "—dump-header" option has been provided.
- Support for certificates in P12 format has been added to the GnuTLS-based crypt backend.
- When using GnuTLS, support for Early Data has been implemented, allowing the client to send data before the TLSv1.3 connection negotiation is complete.
- A setting has been added to disable the IPFS protocol.
- Support for session caching based on the QUIC protocol has been added for GnuTLS and wolfSSL.
- Support for dynamically enabling the ECH (Encrypted Client Hello) TLS extension has been added; this is intended to encrypt information about the parameters of TLS sessions, such as the requested domain name.
- The ability to combine the options "—show-headers" and "—remote-header-name," as well as using the "—skip-existing" option together with "—parallel," has been added.
Daniel Stenberg, the author of the curl project, has introduced an initiative to maintain LTS releases (Rock-solid), with updates addressing critical bugs and vulnerabilities to be provided for at least 5 years. The first LTS project is the 8.9.x branch, for which a corrective release 8.9.2 has already been formed, addressing two vulnerabilities. Access to LTS updates is granted only to clients who have signed a support contract.
The code for LTS releases continues to be distributed under the previous Curl license (MIT variant), but there is an option to provide it under a separate commercial license upon specific request. The funds received will be used to sustain the project and finance the developers. New LTS branches are planned to be formed every 8-24 months. Using the LTS branch will provide a stable base free from the likelihood of regression issues.
Source: opennet.ru
