Skip to content
OpenAdvisories
Medium ALAS2-2018-1121 1 CVE

Moderate: wget security update (Amazon Linux 2)

Published Dec 6, 2018 · Updated Dec 8, 2018

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-0494: A cookie injection flaw was found in wget. An attacker can create a malicious website which, when accessed, overrides cookies belonging to arbitrary domains. 1575634: CVE-2018-0494 wget: Cookie injection allows malicious website to write arbitrary cookie entries into cookie jar

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 wget 0:1.14-18.amzn2
Amazon Linux · 2 wget-debuginfo 0:1.14-18.amzn2

Vulnerabilities 1

  • Unscored —
    CVE-2018-0494 Public exploit EPSS 16%

    GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n seque…

    wget wget wget Debian Ubuntu Alpine

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-0494.html