Advisory ROSA-SA-2021-1996

Software: wget 1.14
OS: Cobalt 7.9

CVE-ID: CVE-2016-7098
CVE-Crit: HIGH
CVE-DESC: The race condition in wget 1.17 and earlier, when used in recursive or mirror mode to download a single file, may allow remote servers to bypass perceived access list restrictions by leaving the HTTP connection open.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2017-6508
CVE-Crit: MEDIUM
CVE-DESC: A CRLF injection vulnerability in the url_parse function in url.c in Wget before version 1.19.1 allows remote attackers to inject arbitrary HTTP headers via CRLF sequences into the host subcomponent of a URL.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2018-20483
CVE-Crit: HIGH
CVE-DESC: set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores the file source URL in the metadata attribute user.xdg.origin.url of the extended attributes of the uploaded file, which allows local users to obtain sensitive information ( such as credentials contained in the URL) by reading this attribute, as shown by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 07/22/2016 in the Wget change log, user.xdg.origin.url is partially based on the fwrite_xattr behavior in tool_xattr.c in curl.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2021-31879
CVE-Crit: MEDIUM
CVE-DESC: GNU Wget through 1.21.1 does not pass the authorization header when redirecting to another source, an issue related to CVE-2018-1000007.
CVE-STATUS: default
CVE-REV: default