CVE-2016-7098 Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP c...
HighCVSS 8.1
EPSS 7.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Race condition in wget 1.17 and earlier, when used in recursive or mirroring mode to download a single file, might allow remote servers to bypass intended access list restrictions by keeping an HTTP connection open.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wget(Debian:12) | < 1.18-4 | 1.18-4 |
| debian/wget(Debian:13) | < 1.18-4 | 1.18-4 |
| debian/wget(Debian:14) | < 1.18-4 | 1.18-4 |
| GNU wget | <= 1.17 | No fix listed |
References
- Debian Security Tracker CVE-2016-7098 vendor-advisory
- bugs.debian.org issue-tracking
- [bug-wget] 20160814 Wget - acess list bypass / race condition PoC exploit mailing-list
- [bug-wget] 20160824 Re: Wget - acess list bypass / race condition PoC mailing-list
- openSUSE-SU-2016:2284 third-party-advisory vendor-advisory
- openSUSE-SU-2017:0015 vendor-advisory
- [oss-security] 20160827 Re: CVE Request - Gnu Wget 1.17 - Design Error Vulnerability mailing-list
- 93157 vdb-entry
- [debian-lts-announce] 20200129 [SECURITY] [DLA 2086-1] wget security update mailing-list
- 40824 exploit