Red Hat Security AdvisoryRHSA-2019:3758
patch security update
Released 2019-11-06 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) patch-2.7.1-11.el7_6
- Red Hat Enterprise Linux Server EUS (v. 7.6) patch-2.7.1-11.el7_6
- Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) patch-2.7.1-11.el7_6
Fixes 2 records
Priority MEDIUM 41
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.04493 · Published 2019-07-26 · Partial fix CWE-78
Priority LOW 39
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02684 · Published 2019-08-16 · Partial fix CWE-78
