MGASA-2018-0244

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2018-0244.html
Import Source
https://advisories.mageia.org/MGASA-2018-0244.json
JSON Data
https://api.test.osv.dev/v1/vulns/MGASA-2018-0244
Related
Published
2018-05-16T08:24:56Z
Modified
2018-05-16T07:44:26Z
Summary
Updated wget packages fix security vulnerabilities
Details

Harry Sintonen discovered that wget does not properly handle '\r\n' from continuation lines while parsing the Set-Cookie HTTP header. A malicious web server could use this flaw to inject arbitrary cookies to the cookie jar file, adding new or replacing existing cookie values (CVE-2018-0494).

The Mageia 6 package has been updated to version 1.19.5, which fixes this issue as well as other possible security issues found by fuzzing. The Mageia 5 package has been patched to fix CVE-2018-0494.

References
Credits

Affected packages

Mageia:6 / wget

Package

Name
wget
Purl
pkg:rpm/mageia/wget?distro=mageia-6

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.19.5-1.mga6

Ecosystem specific 

{
    "section": "core"
}

Mageia:5 / wget

Package

Name
wget
Purl
pkg:rpm/mageia/wget?distro=mageia-5

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.15-5.4.mga5

Ecosystem specific 

{
    "section": "core"
}