CVE-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
OS Command Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.8 HIGH
LOCAL
LOW
NONE
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 90%
Affected Products (NVD)
VendorProductVersion
gnupatch
2.7.6
debiandebian_linux
8.0
debiandebian_linux
9.0
debiandebian_linux
10.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
patch
bookworm
2.7.6-7
fixed
bullseye
2.7.6-7
fixed
sid
2.7.6-7
fixed
trixie
2.7.6-7
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
patch
bionic
Fixed 2.7.6-2ubuntu1.1
released
disco
Fixed 2.7.6-3ubuntu0.1
released
trusty
Fixed 2.7.1-4ubuntu2.4+esm1
released
xenial
Fixed 2.7.5-1ubuntu0.16.04.2
released
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
patch
RHEL 7
0:2.7.1-12.el7_7
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
patch
Amazon Linux 1
0:2.7.1-12.14.amzn1
fixed
Amazon Linux 2
0:2.7.1-12.amzn2
fixed
patch-debuginfo
Amazon Linux 1
0:2.7.1-12.14.amzn1
fixed
Amazon Linux 2
0:2.7.1-12.amzn2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
patch
Azure Linux 3.0
0:2.7.6-9.azl3
fixed
CBL-Mariner 1.0
0:2.7.6-7.cm1
fixed
CBL-Mariner 2.0
0:2.7.6-7.cm2
fixed
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
https://access.redhat.com/errata/RHSA-2019:2798
https://access.redhat.com/errata/RHSA-2019:2964
https://access.redhat.com/errata/RHSA-2019:3757
https://access.redhat.com/errata/RHSA-2019:3758
https://access.redhat.com/errata/RHSA-2019:4061
https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0
https://github.com/irsl/gnu-patch-vulnerabilities
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/
https://seclists.org/bugtraq/2019/Aug/29
https://seclists.org/bugtraq/2019/Jul/54
https://security-tracker.debian.org/tracker/CVE-2019-13638
https://security.gentoo.org/glsa/201908-22
https://security.netapp.com/advisory/ntap-20190828-0001/
https://www.debian.org/security/2019/dsa-4489
http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
https://access.redhat.com/errata/RHSA-2019:2798
https://access.redhat.com/errata/RHSA-2019:2964
https://access.redhat.com/errata/RHSA-2019:3757
https://access.redhat.com/errata/RHSA-2019:3758
https://access.redhat.com/errata/RHSA-2019:4061
https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0
https://github.com/irsl/gnu-patch-vulnerabilities
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/
https://seclists.org/bugtraq/2019/Aug/29
https://seclists.org/bugtraq/2019/Jul/54
https://security-tracker.debian.org/tracker/CVE-2019-13638
https://security.gentoo.org/glsa/201908-22
https://security.netapp.com/advisory/ntap-20190828-0001/
https://www.debian.org/security/2019/dsa-4489