Description
Tails before 1.7 includes the wget program but does not prevent automatic fallback from passive FTP to active FTP, which allows remote FTP servers to discover the Tor client IP address by reading a (1) PORT or (2) EPRT command. NOTE: within wget itself, the automatic fallback is not considered a vulnerability by CVE.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | wget | 1.18-2.3 | openSUSE-SU-2024:10263-1 |
Advisories 1
- openSUSE-SU-2024:10263-1 wget-1.18-2.3 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [tails-dev] 20151002 [Bug-wget] Wget Sending Original IP !! mailing-list
- [tails-dev] 20150813 [Bug-wget] Wget Sending Original IP !! mailing-list
- [oss-security] 20151001 Re: CVE request for wget mailing-list
- https://labs.riseup.net/code/issues/10364
- [bug-wget] 20150810 FTP PORT command code in v1.16.3? mailing-list
- http://git.savannah.gnu.org/cgit/wget.git/commit/?id=075d7556964f5a871a73c22ac4b69f5361295099
- 76678 vdb-entry
- https://tails.boum.org/news/version_1.7/index.en.html