CVE-2019-13638

Published: 22 July 2019

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

Priority

Medium

CVSS 3 base score: 7.8

Status

Package Release Status
patch
Launchpad, Ubuntu, Debian
Upstream
Released (2.7.6-5)
Ubuntu 18.04 LTS (Bionic Beaver)
Released (2.7.6-2ubuntu1.1)
Ubuntu 16.04 LTS (Xenial Xerus)
Released (2.7.5-1ubuntu0.16.04.2)
Ubuntu 14.04 ESM (Trusty Tahr)
Released (2.7.1-4ubuntu2.4+esm1)
Patches:
Upstream: https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0