PT-2019-3242 · Gnu+3 · Gnu Patch+3

Imre Rad · Published 2019-07-22 · Updated 2026-04-01 · CVE-2019-13638

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GNU patch versions prior to 2.7.7

Description The issue is related to the do ed script function in the GNU Patch utility, which fails to neutralize special elements used in operating system commands. This can be exploited by opening a crafted patch file containing an ed style diff payload with shell metacharacters, potentially allowing an attacker to access confidential information and execute arbitrary commands.

Recommendations For GNU patch versions prior to 2.7.7, update to version 2.7.7 or later to resolve the issue. As a temporary workaround, consider avoiding the use of crafted patch files that contain ed style diff payloads with shell metacharacters until a patch is available.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

AZL-35106

AZL-6790

BDU:2019-03232

CESA-2019_2798

CESA-2019_2964

CLEANSTART-2026-NA21773

CLEANSTART-2026-PM79547

CVE-2019-13638

DLA-1864-1

DSA-4489-1

JLSEC-2026-17

MGASA-2020-0093

RHSA-2019:2798

RHSA-2019:2964

RHSA-2019:3757

RHSA-2019:3758

RHSA-2019:4061

RHSA-2019_2798

RHSA-2019_2964

USN-4071-1

USN-4071-2

Affected Products

Centos

Gnu Patch

Red Hat

Ubuntu

References · 59

• https://debian.org/security/2019/dsa-4489 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-13636 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4489-1 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:4061 · Vendor Advisory
• https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4071-2 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-03232 · Security Note
• https://access.redhat.com/errata/RHSA-2019:3757 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2019-2798.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:2798 · Vendor Advisory
• https://osv.dev/vulnerability/CLEANSTART-2026-NA21773 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-13638 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3758 · Vendor Advisory