CVE-2018-0494: Input Validation
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the respnew function in http.c via a \r\n sequence in a continuation line.
Other sources
It was found that GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.
Normally a website should not be able to set cookies for other domains. Due to insufficient input validation GNU Wget can be tricked into storing arbitrary cookie values to the cookie jar file, bypassing this security restriction.
An external attacker is able to inject arbitrary cookie values into cookie jar file, adding new or replacing existing cookie values.
Upstream patch:
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd
References (PoC included):
http://openwall.com/lists/oss-security/2018/05/06/1
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.19.5-1Fixed in 1.18-5+deb9u2Fixed in 1.16-1+deb8u5 - Upgrade
Upgrade
redhat/wgetto a version that resolves this vulnerability.Fixed in 1.19.5 - Upgrade
Upgrade
debian/wgetto a version that resolves this vulnerability.Fixed in 1.21-1+deb11u1Fixed in 1.21-1+deb11u2Fixed in 1.21.3-1+deb12u1Fixed in 1.25.0-2 - Upgrade
Upgrade
GNU Wgetto a version that resolves this vulnerability.Fixed in 1.19.5
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-0494.
What is the title of this vulnerability?
The title of this vulnerability is 'GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http...'.
What is the severity of CVE-2018-0494?
The severity of CVE-2018-0494 is medium with a CVSS score of 6.5.
Which software is affected by CVE-2018-0494?
GNU Wget before 1.19.5 is affected by CVE-2018-0494.
How can I fix CVE-2018-0494?
To fix CVE-2018-0494, you should update GNU Wget to version 1.19.5 or later.