OS Command Injection

Affecting patch package, versions <2.7.5-1+deb9u2

Report new vulnerabilities
Do your applications use this vulnerable package? Test your applications

Overview

do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.

References

CVSS Score

7.8
high severity
  • Attack Vector
    Local
  • Attack Complexity
    Low
  • Privileges Required
    None
  • User Interaction
    Required
  • Scope
    Unchanged
  • Confidentiality
    High
  • Integrity
    High
  • Availability
    High
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVE
CVE-2018-20969
CWE
CWE-78
Snyk ID
SNYK-DEBIAN9-PATCH-459585
Disclosed
16 Aug, 2019
Published
16 Aug, 2019