Unrated severityNVD Advisory· Published Jul 26, 2019· Updated Aug 4, 2024
CVE-2019-13638
CVE-2019-13638
Description
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
6- GNU/patchdescription
- osv-coords4 versions
< 2.7.6-r3+ 3 more
- (no CPE)range: < 2.7.6-r3
- (no CPE)range: < 2.7.6-r3
- (no CPE)range: < 2.7.6-r3
- (no CPE)range: < 2.7.6-r3
Patches
Vulnerability mechanics
References
14- access.redhat.com/errata/RHSA-2019:2798mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:2964mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:3757mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:3758mitrevendor-advisoryx_refsource_REDHAT
- access.redhat.com/errata/RHSA-2019:4061mitrevendor-advisoryx_refsource_REDHAT
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/mitrevendor-advisoryx_refsource_FEDORA
- security.gentoo.org/glsa/201908-22mitrevendor-advisoryx_refsource_GENTOO
- www.debian.org/security/2019/dsa-4489mitrevendor-advisoryx_refsource_DEBIAN
- packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.htmlmitrex_refsource_MISC
- git.savannah.gnu.org/cgit/patch.git/commit/mitrex_refsource_MISC
- seclists.org/bugtraq/2019/Aug/29mitremailing-listx_refsource_BUGTRAQ
- seclists.org/bugtraq/2019/Jul/54mitremailing-listx_refsource_BUGTRAQ
- security-tracker.debian.org/tracker/CVE-2019-13638mitrex_refsource_MISC
- security.netapp.com/advisory/ntap-20190828-0001/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.