It's an old report, they have changed it since:
https://security-tracker.debian.org/tracker/CVE-2018-20483
https://lists.gnu.org/archive/html/bug-wget/2018-12/msg00034...
After @marcan42 noted this wasn't obvious for users: https://twitter.com/marcan42/status/1077676739877232640