{"id":120555,"date":"2024-11-12T13:09:16","date_gmt":"2024-11-12T11:09:16","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/dostupny-utility-wget-1-25-i-curl-8-11-predstavleny-platnye-lts-vypuski-curl"},"modified":"2024-11-12T13:09:16","modified_gmt":"2024-11-12T11:09:16","slug":"dostupny-utility-wget-1-25-i-curl-8-11-predstavleny-platnye-lts-vypuski-curl","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/dostupny-utility-wget-1-25-i-curl-8-11-predstavleny-platnye-lts-vypuski-curl","title":{"rendered":"Utilities wget 1.25 and Curl 8.11 are available. Paid LTS releases of Curl are presented.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The release of GNU Wget 1.25 has been announced, a program for automating file downloads using HTTP\/HTTPS and FTP\/FTPS protocols. The utility supports features such as resuming interrupted downloads, mirroring websites with filtering of downloaded data by patterns, transforming links within documents, setting Cookies, and updating only changed files. The project's code is written in C and is distributed under the GPLv3 license. <\/p>\n
In the new version: <\/p>\n
\n
The parsing of the URL part containing the username (protocol:\/\/userinfo@host:port\/path) has been rewritten. Previously, wget incorrectly processed the character «;» in userinfo parsing, leading to a vulnerability (CVE-2024-38428) because part of the userinfo data could be handled as the host name. For example, the username «attackerhost;» in the URL «ftp:\/\/attackerhost;@host» caused the connection to the host «attackerhost» instead of «host».\n
Support for shortened URL formats for HTTP and FTP resources (without explicit protocol indication, such as «wget username:password@myserver») has been discontinued. This format had previously been deprecated and resulted in the vulnerability CVE-2024-10524. Details about the vulnerability are currently not disclosed, but it appears to be one variant of the previously mentioned issue CVE-2024-38428.\n
Reading from files and standard input (stdin) has been changed to use non-blocking mode. This change allows gradually passing links through the input stream using the command «print_urls | wget -i-«. Previously, wget read the available data and immediately closed the file descriptor. <\/ul>\n
Additionally, the release of a utility for retrieving and sending data over the network \u2014 curl 8.11.0 \u2014 is noteworthy. It provides flexible request formation with parameters such as cookie, user_agent, referer, and any other headers. cURL supports HTTP, HTTPS, HTTP\/2.0, HTTP\/3, SMTP, IMAP, POP3, SSH, Telnet, FTP, LDAP, RTSP, RTMP, and other network protocols. The project code is distributed under the Curl license (a variant of the MIT license). <\/p>\n
Among the changes in curl 8.11: <\/p>\n
\n
A vulnerability (CVE-2024-9681) has been eliminated, which allowed accessing resources via the http:\/\/ protocol despite the presence of HSTS (HTTP Strict Transport Security) rules requiring the use of only HTTPS. The problem manifests when there is control over the subdomains of the targeted host. For instance, when requesting the host x.example.com, an attacker can manipulate the HTTP header «Strict-Transport-Security:» to affect the cached HSTS data. domain<\/a> example.com.\n