Patchwire CVEs, their patch status, and feeds to follow them

CVE-2017-6508

Fixed in a distro release EPSS 3%

CRLF injection vulnerability in the url_parse function in url.c in Wget through 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences in the host subcomponent of a URL.

Published 2017-03-07 · CVE record · OSV

Products: gnu wget

Distro releases

ReleasePackageFixed in
Alpine 3.10wget1.19.1-r1
Alpine 3.11wget1.19.1-r1
Alpine 3.12wget1.19.1-r1
Alpine 3.13wget1.19.1-r1
Alpine 3.14wget1.19.1-r1
Alpine 3.15wget1.19.1-r1
Alpine 3.16wget1.19.1-r1
Alpine 3.17wget1.19.1-r1
Alpine 3.18wget1.19.1-r1
Alpine 3.19wget1.19.1-r1
Alpine 3.2wget1.18-r1
Alpine 3.20wget1.19.1-r1
Alpine 3.21wget1.19.1-r1
Alpine 3.22wget1.19.1-r1
Alpine 3.23wget1.19.1-r1
Alpine 3.24wget1.19.1-r1
Alpine 3.3wget1.17.1-r2
Alpine 3.4wget1.18-r1
Alpine 3.6wget1.19.1-r1
Alpine 3.7wget1.19.1-r1
Alpine 3.8wget1.19.1-r1
Alpine 3.9wget1.19.1-r1
Arch Linuxwget1.19.2-1
Debian 12wget1.19.1-2
Debian 13wget1.19.1-2
Debian 14wget1.19.1-2
Debian 7wget1.13.4-3+deb7u4
SUSE Linux Enterprise Desktop 12 SP1wget1.14-20.1
SUSE Linux Enterprise Desktop 12 SP2wget1.14-20.1
SUSE Linux Enterprise Server 11 SP4wget1.11.4-1.40.1
SUSE Linux Enterprise Server 11-SECURITYwget-openssl11.11.4-1.40.1
SUSE Linux Enterprise Server 12 SP1wget1.14-20.1
SUSE Linux Enterprise Server 12 SP2wget1.14-20.1
SUSE Linux Enterprise Server for Raspberry Pi 12 SP2wget1.14-20.1
SUSE Linux Enterprise Server for SAP Applications 11 SP4wget1.11.4-1.40.1
SUSE Linux Enterprise Server for SAP Applications 12 SP1wget1.14-20.1
SUSE Linux Enterprise Server for SAP Applications 12 SP2wget1.14-20.1
Ubuntu 14.04 LTSwget1.15-1ubuntu1.14.04.3
Ubuntu 16.04 LTSwget1.17.1-1ubuntu1.3
openSUSE Tumbleweedwget1.21.1-2.2