CVE-2018-0494: Input Validation
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the respnew function in http.c via a \r\n sequence in a continuation line.
Other sources
It was found that GNU Wget is susceptible to a malicious web server injecting arbitrary cookies to the cookie jar file.
Normally a website should not be able to set cookies for other domains. Due to insufficient input validation GNU Wget can be tricked into storing arbitrary cookie values to the cookie jar file, bypassing this security restriction.
An external attacker is able to inject arbitrary cookie values into cookie jar file, adding new or replacing existing cookie values.
Upstream patch:
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd
References (PoC included):
http://openwall.com/lists/oss-security/2018/05/06/1
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-0494.
What is the title of this vulnerability?
The title of this vulnerability is 'GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http...'.
What is the severity of CVE-2018-0494?
The severity of CVE-2018-0494 is medium with a CVSS score of 6.5.
Which software is affected by CVE-2018-0494?
GNU Wget before 1.19.5 is affected by CVE-2018-0494.
How can I fix CVE-2018-0494?
To fix CVE-2018-0494, you should update GNU Wget to version 1.19.5 or later.