Red Hat Security AdvisoryRHSA-2019:2964
patch security update
Released 2019-10-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) patch-2.7.1-12.el7_7
- Red Hat Enterprise Linux ComputeNode (v. 7) patch-2.7.1-12.el7_7
- Red Hat Enterprise Linux Server (v. 7) patch-2.7.1-12.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) patch-2.7.1-12.el7_7
Fixes 2 records
Priority MEDIUM 41
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.04493 · Published 2019-07-26 · Partial fix CWE-78
Priority LOW 39
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02684 · Published 2019-08-16 · Partial fix CWE-78
