6.5

CVE-2018-0494

Exploit
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gnu ≫ Wget Version < 1.19.5
Canonical ≫ Ubuntu Linux Version12.04 SwEditionesm
Canonical ≫ Ubuntu Linux Version14.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version16.04 SwEditionlts
Canonical ≫ Ubuntu Linux Version17.10
Canonical ≫ Ubuntu Linux Version18.04 SwEditionlts
Debian ≫ Debian Linux Version7.0
Debian ≫ Debian Linux Version8.0
Debian ≫ Debian Linux Version9.0
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 17.25% 0.967
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 2.8 3.6
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://www.securityfocus.com/bid/104129
Third Party Advisory
VDB Entry
http://www.securitytracker.com/id/1040838
Third Party Advisory
VDB Entry
https://access.redhat.com/errata/RHSA-2018:3052
Third Party Advisory
https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd
Third Party Advisory
https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html
Third Party Advisory
Mailing List
https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html
Patch
Third Party Advisory
https://savannah.gnu.org/bugs/?53763
Broken Link
https://security.gentoo.org/glsa/201806-01
Third Party Advisory
https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt
Third Party Advisory
Exploit
https://usn.ubuntu.com/3643-1/
Third Party Advisory
https://usn.ubuntu.com/3643-2/
Third Party Advisory
https://www.debian.org/security/2018/dsa-4195
Third Party Advisory
https://www.exploit-db.com/exploits/44601/
Third Party Advisory
Exploit
VDB Entry