In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases…
Priority LOW 33CWE-59Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 3 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.
Summary
In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c.
Why it matters now
EPSS 0.03895 90th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 1 fixed, 3 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
Red Hat 1 advisory
- RHSA-2020:1852 Released 2020-04-28 · Red Hat rating Moderatepatch security and bug fix update
- Red Hat Enterprise Linux BaseOS (v. 8) patch-2.7.6-11.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2020:1852 |
Timeline
- 2026-10-02 Threatist record created from CVE-2019-13636
- 2026-10-03 Alias added: GHSA-f3xm-hqch-mq3q
- 2026-10-11 EPSS moved to the 90th–95th percentile
References
Patch 1
Advisory 6
Other 5
- 20190730 [SECURITY] [DSA 4489-1] patch security update
- 20190816 Details about recent GNU patch vulnerabilities
- http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html
- https://security.netapp.com/advisory/ntap-20190828-0001/
- https://github.com/irsl/gnu-patch-vulnerabilities
More GNU Patch vulnerabilities
- TI-2015-01271 Directory traversal vulnerability in GNU patch versions which support Git-style patching… CVSS 3.0HIGH 7.5
- TI-2018-05076 A double free exists in the another_hunk function in pch.c in GNU patch through 2.7.6. CVSS 3.0HIGH 7.5
- TI-2018-05075 An issue was discovered in GNU patch through 2.7.6. CVSS 3.0HIGH 7.5
- TI-2018-15808 GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch… CVSS 3.0HIGH 7.8
- TI-2019-10248 GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited… CVSS 3.0HIGH 7.8
- TI-2018-14931 do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a… CVSS 3.0HIGH 7.8
Sources
- CVE-2019-13636 · CVE Program
- CVE-2019-13636 · NVD
- FIRST EPSS
- GHSA-f3xm-hqch-mq3q · GitHub Advisory Database · CC BY 4.0
- CVE-2019-13636 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences