Red Hat Security AdvisoryRHSA-2019:4061
patch security update
Released 2019-12-03 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server AUS (v. 7.4) patch-2.7.1-11.el7_4
- Red Hat Enterprise Linux Server E4S (v. 7.4) patch-2.7.1-11.el7_4
- Red Hat Enterprise Linux Server TUS (v. 7.4) patch-2.7.1-11.el7_4
Fixes 2 records
Priority MEDIUM 41
GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.04493 · Published 2019-07-26 · Partial fix CWE-78
Priority LOW 39
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character.
CVSS 3.0HIGH 7.8· Local · No auth · User interaction · EPSS 0.02684 · Published 2019-08-16 · Partial fix CWE-78
