CVE-2018-20483

Name	CVE-2018-20483
Description	set_file_metadata in xattr.c in GNU Wget before 1.20.1 stores a file's origin URL in the user.xdg.origin.url metadata attribute of the extended attributes of the downloaded file, which allows local users to obtain sensitive information (e.g., credentials contained in the URL) by reading this attribute, as demonstrated by getfattr. This also applies to Referer information in the user.xdg.referrer.url metadata attribute. According to 2016-07-22 in the Wget ChangeLog, user.xdg.origin.url was partially based on the behavior of fwrite_xattr in tool_xattr.c in curl.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	917375

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
wget (PTS)	bullseye	1.21-1+deb11u1	fixed
	bookworm	1.21.3-1	fixed
	sid, trixie	1.24.5-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
wget	source	jessie	(not affected)
wget	source	stretch	(not affected)
wget	source	(unstable)	1.20.1-1	917375

Notes

[stretch] - wget <not-affected> (Vulnerable code introduced in 1.19)
[jessie] - wget <not-affected> (Vulnerable code introduced in 1.19)
https://twitter.com/marcan42/status/1077676739877232640
Fixed by: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=3cdfb594cf75f11cdbb9702ac5e856c332ccacfa
Don't use extended attributes by default: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=c125d24762962d91050d925fbbd9e6f30b2302f8
Introduced by: https://git.savannah.gnu.org/cgit/wget.git/commit/?id=a933bdd31eee9c956a3b5cc142f004ef1fa94cb3 (v1.19)