REDHAT-BUG-1564326: High severity gnu patch vulnerability
Published Apr 6, 2018
·Updated
GNU patch does not properly sanitize patch files allowing for malicious patches to pass arbitrary shell commands to ed. An attacker could exploit this by tricking a user into applying malicious patches with the patch command.
Affected Software
1 affected component
GNU patch
Event History
Apr 6, 2018
Data Sourced
via Red Hat·12:36 AM
DescriptionSeverityAffected Software
Frequently Asked Questions
1
What is the severity of REDHAT-BUG-1564326?
The severity of REDHAT-BUG-1564326 is considered high due to the potential for arbitrary command execution.
2
How do I fix REDHAT-BUG-1564326?
To fix REDHAT-BUG-1564326, update the GNU patch software to the latest version provided by your vendor.
3
What platforms are affected by REDHAT-BUG-1564326?
REDHAT-BUG-1564326 affects systems utilizing the GNU patch utility.
4
Who is affected by REDHAT-BUG-1564326?
Users of the GNU patch command who apply untrusted patches are particularly at risk from REDHAT-BUG-1564326.
5
What type of attack does REDHAT-BUG-1564326 enable?
REDHAT-BUG-1564326 enables attackers to execute arbitrary shell commands through malicious patch files.