Bug 41662
| Summary: | wget: minor issues (4.1) | ||
|---|---|---|---|
| Product: | UCS | Reporter: | Arvid Requate <requate> |
| Component: | Security updates | Assignee: | Arvid Requate <requate> |
| Status: | CLOSED FIXED | QA Contact: | Jürn Brodersen <brodersen> |
| Severity: | normal | ||
| Priority: | P5 | CC: | best |
| Version: | UCS 4.1 | Flags: | requate:
Patch_Available+
|
| Target Milestone: | UCS 4.1-4-errata | ||
| Hardware: | Other | ||
| OS: | Linux | ||
| What kind of report is it?: | Security Issue | What type of bug is this?: | --- |
| Who will be affected by this bug?: | --- | How will those affected feel about the bug?: | --- |
| User Pain: | Enterprise Customer affected?: | ||
| School Customer affected?: | ISV affected?: | ||
| Waiting Support: | Flags outvoted (downgraded) after PO Review: | ||
| Ticket number: | Bug group (optional): | Security | |
| Max CVSS v3 score: | 6.1 (CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) | ||
| Bug Depends on: | |||
| Bug Blocks: | 45179 | ||
|
Description
Arvid Requate
* Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open (CVE-2016-7098) Upstream Debian package version 1.13.4-3+deb7u4 fixes this issue: * CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL (CVE-2017-6508) CVE-2016-4971 has been fixed in 1.13.4-3+deb7u3. CVE-2016-7098 will probably not get fixed (CVSS: 2.6 AV:N/AC:H/Au:N/C:N/I:P/A:N) repo_admin.py -U -d wheezy -r 4.1 -s errata4.1-4 -p wget b41-scope errata4.1-4 wget Advisory: wget.yaml Looks good What I tested: wget univention.de -> works -> OK changelog -> OK YAML -> OK Verified |