REDHAT-BUG-1733916: Command Injection
A vulnerability was found in GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
Reference: https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1733916?
The vulnerability REDHAT-BUG-1733916 is classified as a medium severity issue due to the potential for OS shell command injection.
How do I fix REDHAT-BUG-1733916?
To remediate REDHAT-BUG-1733916, update the GNU patch to version 2.7.7 or later, which addresses the vulnerability.
What products are affected by REDHAT-BUG-1733916?
The vulnerability REDHAT-BUG-1733916 affects GNU patch versions up to and including 2.7.6.
What type of attack does REDHAT-BUG-1733916 facilitate?
REDHAT-BUG-1733916 facilitates OS shell command injection attacks via crafted patch files.
Is the ed editor required for exploiting REDHAT-BUG-1733916?
No, the ed editor does not need to be present on the system to exploit REDHAT-BUG-1733916.