CVE-2018-0494: canonical ubuntu_linux Improper Input Validation
CVSS: 6.5v3.0MediumModified
AliasesALPINE-CVE-2018-0494MGASA-2018-0244SUSE-SU-2018:1367-1SUSE-SU-2018:1373-1RHSA-2018:3052UBUNTU-CVE-2018-0494USN-3643-1DEBIAN-CVE-2018-0494DLA-1375-1DSA-4195-1
Published 06-05-2018Last modified 05-08-2024
Vulnerability summary
CVE-2018-0494 is a medium (CVSS 6.5) Improper Input Validation vulnerability in canonical ubuntu_linux. EPSS estimates a 16.49% chance of exploitation in the next 30 days, higher than 96.9% of scored vulnerabilities. 2 public exploits are recorded.
CVSS score
6.5/10
010
Medium · v3.0 (NVD)EPSS score
16.49%
0%100%
Medium · -0.30 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference, exploit-database
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 06-05-2018PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
GNU Wget before 1.19.5 is prone to a cookie injection vulnerability in the resp_new function in http.c via a \r\n sequence in a continuation line.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 6.5Preferred score · NVD (NIST)
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NSources5 sources · 6.5–7.1
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · Red hatEcosystem advisory · calculated7.1HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:NDiffers
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:P/A:NSourcesSingle source
EPSS trend
Probability
16.49%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
-0.30 pp
From 16.79% on 18-09-2026
18-09-202618-10-2026
EPSS score16.49%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (sintonen.fi)
Maturity: unknown
GNU wget - Cookie Injection
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Suse6 products
- wget-openssl1&distro=SUSE Linux Enterprise Server 11-SECURITY< 1.11.4-1.41.3.1
- wget&distro=SUSE Linux Enterprise Desktop 12 SP3< 1.14-21.7.1
- wget&distro=SUSE Linux Enterprise Server 11 SP4< 1.11.4-1.41.3.1
- wget&distro=SUSE Linux Enterprise Server 12 SP3< 1.14-21.7.1
- wget&distro=SUSE Linux Enterprise Server for SAP Applications 11 SP4< 1.11.4-1.41.3.1
Redhat5 products
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_workstation7.0
- wget< 0:1.14-18.el7
- wget-debuginfo< 0:1.14-18.el7
Debian2 products
- wget< 1.19.5-1 | < 1.16-1+deb8u5 | < 1.18-5+deb9u2 | < 1.13.4-3+deb7u6
- debian_linuxEOL7.0 | 8.0 | 9.0
Mageia2 products
- wget< 1.15-5.4.mga5
- wget< 1.19.5-1.mga6
Alpine1 product
- wget< 1.19.5-r0 | < 1.18-r3 | < 1.18-r4
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 16.04 | 17.10 | 18.04
Gnu1 product
- wget< 1.19.5
Ubuntu1 product
- wget< 1.15-1ubuntu1.14.04.4 | < 1.17.1-1ubuntu1.4 | < 1.19.4-1ubuntu2.1
8 vendors · 19 products
References
32 links- sintonen.fi/advisories/gnu-wget-cookie-injection.txtX Refsource MISCExploitThird Party AdvisoryREPORT
- access.redhat.com/errata/RHSA-2018:3052Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
- git.savannah.gnu.org/cgit/wget.git/commit/?id=1fc9c95ec144499e69dc8ec76dbe07799d7d82cdX Refsource MISCThird Party Advisory
Show all 32 references
- lists.debian.org/debian-lts-announce/2018/05/msg00006.htmlMailing ListX Refsource MLISTThird Party Advisory
- lists.gnu.org/archive/html/bug-wget/2018-05/msg00020.htmlX Refsource MISCPatchThird Party AdvisoryREPORT
