CVE-2019-13636 :: Enginsight Vulnerability Database

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.9 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 88%

Affected Products (NVD)

Vendor	Product	Version
gnu	patch	𝑥 ≤ 2.7.6

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

patch

bookworm	2.7.6-7 fixed
bullseye	2.7.6-7 fixed
sid	2.7.6-7 fixed
trixie	2.7.6-7 fixed

Ubuntu Releases

Ubuntu Product

Codename

patch

bionic	Fixed 2.7.6-2ubuntu1.1 released
disco	Fixed 2.7.6-3ubuntu0.1 released
trusty	Fixed 2.7.1-4ubuntu2.4+esm1 released
xenial	Fixed 2.7.5-1ubuntu0.16.04.2 released

Common Weakness Enumeration

CWE-59 - Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

References

http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html

https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a

https://github.com/irsl/gnu-patch-vulnerabilities

https://lists.debian.org/debian-lts-announce/2019/07/msg00016.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/

https://seclists.org/bugtraq/2019/Aug/29

https://seclists.org/bugtraq/2019/Jul/54

https://security.gentoo.org/glsa/201908-22

https://security.netapp.com/advisory/ntap-20190828-0001/

https://usn.ubuntu.com/4071-1/

https://usn.ubuntu.com/4071-2/

https://www.debian.org/security/2019/dsa-4489

http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html

https://git.savannah.gnu.org/cgit/patch.git/commit/?id=dce4683cbbe107a95f1f0d45fabc304acfb5d71a

https://github.com/irsl/gnu-patch-vulnerabilities

https://lists.debian.org/debian-lts-announce/2019/07/msg00016.html

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/

https://seclists.org/bugtraq/2019/Aug/29

https://seclists.org/bugtraq/2019/Jul/54

https://security.gentoo.org/glsa/201908-22

https://security.netapp.com/advisory/ntap-20190828-0001/

https://usn.ubuntu.com/4071-1/

https://usn.ubuntu.com/4071-2/

https://www.debian.org/security/2019/dsa-4489