{"id":"CVE-2018-0494","aliases":["ALPINE-CVE-2018-0494","BELL-CVE-2018-0494","DEBIAN-CVE-2018-0494","DLA-1375-1","DSA-4195-1","EUVD-2018-1317","GHSA-7cw3-q27m-9w5f","MGASA-2018-0244","RHSA-2018:3052","SUSE-SU-2018:1367-1","SUSE-SU-2018:1373-1","UBUNTU-CVE-2018-0494","USN-3643-1","openSUSE-SU-2024:11510-1"],"status":"published","title":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in...","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.16488,"percentile":0.97011,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2018-05-06T00:00:00Z","modified":"2026-11-06T02:45:05Z","exploits":[{"source":"exploitdb","id":"EDB-44601","title":"GNU wget - Cookie Injection","type":"local","platform":"linux","date":"2018-05-06","url":"https://www.exploit-db.com/exploits/44601"}],"fixes":[{"ecosystem":"Alpine:v3.10","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.4","package":"wget","fixed_in":["1.18-r3"],"sources":["osv"]},{"ecosystem":"Alpine:v3.5","package":"wget","fixed_in":["1.18-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.6","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"wget","fixed_in":["1.19.5-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"wget","fixed_in":["1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"wget","fixed_in":["1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"wget","fixed_in":["1.19.5-1"],"sources":["osv"]},{"ecosystem":"Debian:7","package":"wget","fixed_in":["1.13.4-3+deb7u6"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"wget","fixed_in":["1.16-1+deb8u5"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"wget","fixed_in":["1.18-5+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"wget","fixed_in":["1.15-5.4.mga5"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"wget","fixed_in":["1.19.5-1.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget-debuginfo","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget-debuginfo","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget-debuginfo","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget-debuginfo","fixed_in":["0:1.14-18.el7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"wget-openssl1","fixed_in":["1.11.4-1.41.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"wget","fixed_in":["1.11.4-1.41.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"wget","fixed_in":["1.11.4-1.41.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"wget","fixed_in":["1.14-21.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"wget","fixed_in":["1.14-21.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"wget","fixed_in":["1.14-21.7.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"wget","fixed_in":["1.15-1ubuntu1.14.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"wget","fixed_in":["1.17.1-1ubuntu1.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"wget","fixed_in":["1.19.4-1ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-r3"}]}]},{"source":"osv","ecosystem":"Alpine:v3.5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.4-3+deb7u6"}]}],"versions":["1.13.4-3","1.13.4-3+deb7u1","1.13.4-3+deb7u2","1.13.4-3+deb7u3","1.13.4-3+deb7u4","1.13.4-3+deb7u5"]},{"source":"osv","ecosystem":"Debian:8","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-1+deb8u5"}]}],"versions":["1.16-1","1.16-1+deb8u1","1.16-1+deb8u2","1.16-1+deb8u4"]},{"source":"osv","ecosystem":"Debian:9","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.18-5+deb9u2"}]}],"versions":["1.18-5","1.18-5+deb9u1"]},{"source":"osv","ecosystem":"Mageia:5","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-5.4.mga5"}]}]},{"source":"osv","ecosystem":"Mageia:6","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.5-1.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"wget-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.14-18.el7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11-SECURITY","package":"wget-openssl1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.41.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.41.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.11.4-1.41.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14-21.7.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.4"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.4"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.1"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15-1ubuntu1.14.04.4"}]}],"versions":["1.14-2ubuntu1","1.14-5ubuntu1","1.15-1ubuntu1","1.15-1ubuntu1.14.04.1","1.15-1ubuntu1.14.04.2","1.15-1ubuntu1.14.04.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.1-1ubuntu1.4"}]}],"versions":["1.16.1-1ubuntu1","1.17.1-1ubuntu1","1.17.1-1ubuntu1.1","1.17.1-1ubuntu1.2","1.17.1-1ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.4-1ubuntu2.1"}]}],"versions":["1.19.1-3ubuntu1","1.19.1-3ubuntu1.1","1.19.2-1ubuntu1","1.19.3-2ubuntu1","1.19.4-1ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wget","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.1-2.2"}]}],"bundled":7}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"wget"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://sintonen.fi/advisories/gnu-wget-cookie-injection.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","report"]},{"url":"https://access.redhat.com/errata/RHSA-2018:3052","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://savannah.gnu.org/bugs/?53763","tags":["x_refsource_MISC","x_transferred","Broken Link","web"]},{"url":"https://git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cd","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201806-01","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2018/dsa-4195","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://www.securityfocus.com/bid/104129","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.securitytracker.com/id/1040838","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://www.exploit-db.com/exploits/44601/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://usn.ubuntu.com/3643-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/05/msg00006.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3643-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-0494","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-7cw3-q27m-9w5f"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-0494","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-0494","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-0494","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0244.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23002","tags":["report"]},{"url":"http://openwall.com/lists/oss-security/2018/05/06/1","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1575634","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3052.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-0494","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-0494","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181367-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1092061","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-0494","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181373-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2018-0494","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3643-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-3643-2","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-6719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13090","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6508","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-20483","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5953","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:00:00Z","modified":"2024-08-05T03:28:10.61Z","updated_at":"2026-11-02T14:35:12.160284Z"}],"euvd":[{"id":"EUVD-2018-1317","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:00:00Z","modified":"2024-08-05T03:28:10Z","updated_at":"2026-11-03T02:40:18.31448Z"}],"ghsa":[{"id":"GHSA-7cw3-q27m-9w5f","title":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in...","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2022-05-14T01:20:23Z","modified":"2023-02-02T05:03:34Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:51:39.940381Z"}],"nvd":[{"id":"CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:29:00.217Z","modified":"2026-06-17T01:30:57.38Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:26.098615Z"}],"osv":[{"id":"ALPINE-CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:29:00.217Z","modified":"2026-10-23T17:17:55.143299095Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:47.187336Z"},{"id":"BELL-CVE-2018-0494","title":"CVE-2018-0494 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:34.959492Z","modified":"2026-01-26T09:50:12.834545Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:29:00.217Z","modified":"2026-11-09T02:45:04.031287759Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-09T03:16:44.651171Z"},{"id":"DEBIAN-CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T22:29:00.217Z","modified":"2026-10-23T18:02:55.28159897Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:3052","title":"Red Hat Security Advisory: wget security and bug fix update","status":"published","published":"2024-09-16T01:09:00Z","modified":"2026-06-26T10:39:15Z","cvss":[{"version":"3.0","score":7.1,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:05.383061Z"},{"id":"UBUNTU-CVE-2018-0494","description":"GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \\r\\n sequence in a continuation line.","status":"published","published":"2018-05-06T00:00:00Z","modified":"2026-02-04T03:21:51.31637Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:16.154988Z"},{"id":"DLA-1375-1","title":"wget - security update","status":"published","published":"2018-05-11T00:00:00Z","modified":"2026-03-09T01:00:50.202287Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"DSA-4195-1","title":"wget - security update","status":"published","published":"2018-05-08T00:00:00Z","modified":"2026-03-09T01:22:51.52851Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0244","title":"Updated wget packages fix security vulnerabilities","description":"Harry Sintonen discovered that wget does not properly handle '\\r\\n' from\ncontinuation lines while parsing the Set-Cookie HTTP header. A malicious\nweb server could use this flaw to inject arbitrary cookies to the cookie\njar file, adding new or replacing existing cookie values (CVE-2018-0494).\n\nThe Mageia 6 package has been updated to version 1.19.5, which fixes this\nissue as well as other possible security issues found by fuzzing.  The\nMageia 5 package has been patched to fix CVE-2018-0494.\n","status":"published","published":"2018-05-16T08:24:56Z","modified":"2026-04-16T06:22:21.675715127Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:11510-1","title":"wget-1.21.1-2.2 on GA media","description":"These are all security issues fixed in the wget-1.21.1-2.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:17:43.041338Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2018:1367-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2018-0494: Fixed Cookie injection vulnerability by checking for\n  and joining continuation lines. (bsc#1092061)\n\n","status":"published","published":"2018-05-22T18:01:16Z","modified":"2026-02-04T03:13:00.605634Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"SUSE-SU-2018:1373-1","title":"Security update for wget","description":"This update for wget fixes the following issues:\n\n- CVE-2018-0494: Fixed a cookie injection vulnerability by checking for\n  and joining continuation lines. (bsc#1092061)\n\n","status":"published","published":"2018-05-22T13:14:12Z","modified":"2026-02-04T03:39:59.834245Z","updated_at":"2026-11-02T15:53:44.972817Z"},{"id":"USN-3643-1","title":"wget vulnerability","description":"It was discovered that Wget incorrectly handled certain inputs.\nAn attacker could possibly use this to inject arbitrary cookie values.\n","status":"published","published":"2018-05-09T13:11:27Z","modified":"2026-02-10T04:41:20Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}