CVE-2019-13638
Fixed in a distro release EPSS 4%
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
Products: gnu patch, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | patch | 2.7.6-r6 |
| Alpine 3.11 | patch | 2.7.6-r6 |
| Alpine 3.12 | patch | 2.7.6-r6 |
| Alpine 3.13 | patch | 2.7.6-r6 |
| Alpine 3.14 | patch | 2.7.6-r6 |
| Alpine 3.15 | patch | 2.7.6-r6 |
| Alpine 3.16 | patch | 2.7.6-r6 |
| Alpine 3.17 | patch | 2.7.6-r6 |
| Alpine 3.18 | patch | 2.7.6-r6 |
| Alpine 3.19 | patch | 2.7.6-r6 |
| Alpine 3.20 | patch | 2.7.6-r6 |
| Alpine 3.21 | patch | 2.7.6-r6 |
| Alpine 3.22 | patch | 2.7.6-r6 |
| Alpine 3.23 | patch | 2.7.6-r6 |
| Alpine 3.24 | patch | 2.7.6-r6 |
| Alpine 3.7 | patch | 2.7.6-r0 |
| Alpine 3.8 | patch | 2.7.6-r4 |
| Alpine 3.9 | patch | 2.7.6-r6 |
| Amazon Linux 2 | patch | 2.7.1-12.amzn2 |
| Chainguard | patch | 2.7.6-r3 |
| Debian 10 | patch | 2.7.6-3+deb10u1 |
| Debian 12 | patch | 2.7.6-5 |
| Debian 13 | patch | 2.7.6-5 |
| Debian 14 | patch | 2.7.6-5 |
| Debian 8 | patch | 2.7.5-1+deb8u3 |
| Debian 9 | patch | 2.7.5-1+deb9u2 |
| Red Hat Enterprise Linux 7 | patch | 0:2.7.1-12.el7_7 |
| Red Hat Enterprise Linux 7 | patch-debuginfo | 0:2.7.1-12.el7_7 |
| Red Hat Enterprise Linux 8 | patch | 0:2.7.6-9.el8_0 |
| Red Hat Enterprise Linux 8 | patch-debuginfo | 0:2.7.6-9.el8_0 |
| Red Hat Enterprise Linux 8 | patch-debugsource | 0:2.7.6-9.el8_0 |
| Red Hat rhel aus 7.4 | patch | 0:2.7.1-11.el7_4 |
| Red Hat rhel aus 7.4 | patch-debuginfo | 0:2.7.1-11.el7_4 |
| Red Hat rhel e4s 7.4 | patch | 0:2.7.1-11.el7_4 |
| Red Hat rhel e4s 7.4 | patch-debuginfo | 0:2.7.1-11.el7_4 |
| Red Hat rhel eus 7.5 | patch | 0:2.7.1-11.el7_5 |
| Red Hat rhel eus 7.5 | patch-debuginfo | 0:2.7.1-11.el7_5 |
| Red Hat rhel eus 7.6 | patch | 0:2.7.1-11.el7_6 |
| Red Hat rhel eus 7.6 | patch-debuginfo | 0:2.7.1-11.el7_6 |
| Red Hat rhel tus 7.4 | patch | 0:2.7.1-11.el7_4 |
| Red Hat rhel tus 7.4 | patch-debuginfo | 0:2.7.1-11.el7_4 |
| Ubuntu 16.04 LTS | patch | 2.7.5-1ubuntu0.16.04.2 |
| Ubuntu 18.04 LTS | patch | 2.7.6-2ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | patch | 2.7.1-4ubuntu2.4+esm1 |
| Wolfi | patch | 2.7.6-r3 |