CVE-2018-12910 The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
CriticalCVSS 9.8
EPSS 4.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The get_cookies function in soup-cookie-jar.c in libsoup 2.63.2 allows attackers to have unspecified impact via an empty hostname.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/libsoup2.4(Debian:12) | < 2.62.2-2 | 2.62.2-2 |
| debian/libsoup2.4(Debian:13) | < 2.62.2-2 | 2.62.2-2 |
| GNOME libsoup | = 2.63.2 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 16.04 | No fix listed |
| Canonical Ubuntu Linux | = 17.10 | No fix listed |
| Canonical Ubuntu Linux | = 18.04 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| redhat ansible tower | = 3.3 | No fix listed |
| redhat openshift container platform | = 3.11 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| openSUSE leap | = 15.0 | No fix listed |
References
- Debian Security Tracker CVE-2018-12910 vendor-advisory
- openSUSE-SU-2019:1310 mailing-list third-party-advisory vendor-advisory
- RHBA-2019:0327 third-party-advisory vendor-advisory
- RHSA-2018:3140 third-party-advisory vendor-advisory
- RHSA-2018:3505 third-party-advisory vendor-advisory
- gitlab.gnome.org patch third-party-advisory
- gitlab.gnome.org patch third-party-advisory vendor-advisory
- gitlab.gnome.org third-party-advisory
- [debian-lts-announce] 20180706 [SECURITY] [DLA 1416-1] libsoup2.4 security update mailing-list third-party-advisory
- FEDORA-2018-fb2afee474 vendor-advisory
- USN-3701-1 third-party-advisory vendor-advisory
- DSA-4241 third-party-advisory vendor-advisory