High
busybox — security advisory
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
- Products
- busybox
- Affected versions
- 1:1.35.0-4, 1:1.35.0-4+deb12u1, 1:1.36.0-1~exp1, 1:1.36.1-1, 1:1.36.1-2, 1:1.36.1-3, 1:1.36.1-3.1, 1:1.36.1-4, 1:1.36.1-5, 1:1.36.1-6, 1:1.36.1-6~exp.1, 1:1.36.1-7, 1:1.36.1-8, 1:1.36.1-9, 1:1.37.0-1, 1:1.37.0-10, 1:1.37.0-10.1, 1:1.37.0-2, 1:1.37.0-3, 1:1.37.0-4, 1:1.37.0-5, 1:1.37.0-6, 1:1.37.0-7, 1:1.37.0-8, 1:1.37.0-9, 1:1.38.0-1, 1:1.38.0-2, 1:1.38.0-3
- Fixed versions
- Not specified
- CVEs
- CVE-2018-1000500
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 00:24 UTC · Revision 1
Source evidence
Busybox contains a Missing SSL certificate validation vulnerability in The "busybox wget" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using "busybox wget https://compromised-domain.com/important-file".
osv:DEBIAN-CVE-2018-1000500
busybox
Fixed versions: Not specified
busybox
Fixed versions: Not specified
busybox
Fixed versions: Not specified
Complete source record
{
"id": "b97e18bb7013d3daf7de3d1f8492fcde29ef2282e66176e26a94e988025be739",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2018-1000500",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2018-1000500",
"summary": "Busybox contains a Missing SSL certificate validation vulnerability in The \"busybox wget\" applet that can result in arbitrary code execution. This attack appear to be exploitable via Simply download any file over HTTPS using \"busybox wget https://compromised-domain.com/important-file\".",
"evidence": "osv:DEBIAN-CVE-2018-1000500",
"products": [
{
"name": {
"value": "busybox",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.35.0-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.35.0-4+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.0-1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-3",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-3.1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-5",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-6",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-6~exp.1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-7",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-8",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.36.1-9",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-10",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-10.1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-3",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-4",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-5",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-6",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-7",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-8",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.37.0-9",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.38.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.38.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "1:1.38.0-3",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "busybox",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.37.0-10",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.37.0-10.1",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.37.0-6",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.37.0-7",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.37.0-8",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.37.0-9",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.38.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.38.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "1:1.38.0-3",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "busybox",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "1:1.37.0-10",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.37.0-10.1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.37.0-6",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.37.0-7",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.37.0-8",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.37.0-9",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.38.0-1",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.38.0-2",
"evidence": "/affected/2/versions"
},
{
"value": "1:1.38.0-3",
"evidence": "/affected/2/versions"
}
]
}
],
"severity": "high",
"structured": {
"id": "DEBIAN-CVE-2018-1000500",
"aliases": [
"DEBIAN-CVE-2018-1000500"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "busybox",
"purl": "pkg:deb/debian/busybox?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"1:1.35.0-4",
"1:1.35.0-4+deb12u1",
"1:1.36.0-1~exp1",
"1:1.36.1-1",
"1:1.36.1-2",
"1:1.36.1-3",
"1:1.36.1-3.1",
"1:1.36.1-4",
"1:1.36.1-5",
"1:1.36.1-6",
"1:1.36.1-6~exp.1",
"1:1.36.1-7",
"1:1.36.1-8",
"1:1.36.1-9",
"1:1.37.0-1",
"1:1.37.0-10",
"1:1.37.0-10.1",
"1:1.37.0-2",
"1:1.37.0-3",
"1:1.37.0-4",
"1:1.37.0-5",
"1:1.37.0-6",
"1:1.37.0-7",
"1:1.37.0-8",
"1:1.37.0-9",
"1:1.38.0-1",
"1:1.38.0-2",
"1:1.38.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000500.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "busybox",
"purl": "pkg:deb/debian/busybox?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"1:1.37.0-10",
"1:1.37.0-10.1",
"1:1.37.0-6",
"1:1.37.0-7",
"1:1.37.0-8",
"1:1.37.0-9",
"1:1.38.0-1",
"1:1.38.0-2",
"1:1.38.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000500.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "busybox",
"purl": "pkg:deb/debian/busybox?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"1:1.37.0-10",
"1:1.37.0-10.1",
"1:1.37.0-6",
"1:1.37.0-7",
"1:1.37.0-8",
"1:1.37.0-9",
"1:1.38.0-1",
"1:1.38.0-2",
"1:1.38.0-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2018-1000500.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
],
"modified": "2026-10-23T18:03:17.739122247Z",
"provider": "osv",
"upstream": [
"CVE-2018-1000500"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2018-1000500"
]
},
"related_cves": [
{
"value": "CVE-2018-1000500",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 421040,
"published_at": "2018-06-26T16:29:00.353+00:00"
}