Vulnerability Description
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gnu | Patch | 2.7.6 |
| Debian | Debian Linux | 8.0 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Director
- https://access.redhat.com/errata/RHSA-2019:2798
- https://access.redhat.com/errata/RHSA-2019:2964
- https://access.redhat.com/errata/RHSA-2019:3757
- https://access.redhat.com/errata/RHSA-2019:3758
- https://access.redhat.com/errata/RHSA-2019:4061
- https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5Mailing ListPatchVendor Advisory
- https://github.com/irsl/gnu-patch-vulnerabilities
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://seclists.org/bugtraq/2019/Aug/29
- https://seclists.org/bugtraq/2019/Jul/54Mailing ListThird Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2019-13638Third Party Advisory
- https://security.gentoo.org/glsa/201908-22
- https://security.netapp.com/advisory/ntap-20190828-0001/
- https://www.debian.org/security/2019/dsa-4489Third Party Advisory
FAQ
What is CVE-2019-13638?
CVE-2019-13638 is a vulnerability with a CVSS score of 7.8 (HIGH). GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed edito...
How severe is CVE-2019-13638?
CVE-2019-13638 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-13638?
Check the references section above for vendor advisories and patch information. Affected products include: Gnu Patch, Debian Debian Linux.