CVE-2019-13638: Command Injection
A vulnerability was found in GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
Reference: https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-13638?
CVE-2019-13638 is a vulnerability in the GNU patch tool that allows for OS shell command injection.
How severe is CVE-2019-13638?
CVE-2019-13638 has a severity score of 7.8, which is considered critical.
What software is affected by CVE-2019-13638?
The GNU patch tool versions 2.7.6 and below are affected by CVE-2019-13638.
How can CVE-2019-13638 be exploited?
CVE-2019-13638 can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters.
Are there any patches available for CVE-2019-13638?
Yes, patches are available to address the vulnerability. Please refer to the official references for remediation information.