UBUNTU-CVE-2018-20483

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2018-20483

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2018/UBUNTU-CVE-2018-20483.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2018-20483

Related

Published

2018-12-26T00:00:00Z

Modified

2018-12-26T00:00:00Z

Severity

7.8 (High) CVSS_V3 - CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

setfilemetadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwritexattr in toolxattr.c in curl.

References

Affected packages

Ubuntu:18.04:LTS / wget

Package

Name: wget
Purl: pkg:deb/ubuntu/wget?arch=src?distro=bionic

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.19.4-1ubuntu2.2

Affected versions

1.*

1.19.1-3ubuntu1

1.19.1-3ubuntu1.1

1.19.2-1ubuntu1

1.19.3-2ubuntu1

1.19.4-1ubuntu2

1.19.4-1ubuntu2.1

Ecosystem specific

{
    "availability": "No subscription required",
    "ubuntu_priority": "low",
    "binaries": [
        {
            "binary_version": "1.19.4-1ubuntu2.2",
            "binary_name": "wget"
        },
        {
            "binary_version": "1.19.4-1ubuntu2.2",
            "binary_name": "wget-dbgsym"
        },
        {
            "binary_version": "1.19.4-1ubuntu2.2",
            "binary_name": "wget-udeb"
        }
    ]
}