OS Command Injection in GNU patch - CVE-2018-20969

Vulnerability identifier: #VU20411

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-20969

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The vulnerability exists due to the "do_ed_script" function in the "pch.c" file does not block strings beginning with a ! character. A remote unauthenticated attacker can trick a victim to open a specially crafted patch file and execute arbitrary OS shell commands on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

GNU patch
patch (Alpine package)
patch (Red Hat package)
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

patch (Red Hat package) - update to 2.7.1-11.el7_6
patch (Alpine package) - update to 2.7.6-r6

• https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0

• Red Hat update for patch
• Red Hat update for patch
• Amazon Linux AMI update for patch
• Red Hat update for patch
• Red Hat update for patch
• OS Command Injection in patch (Alpine package)
• Red Hat Enterprise Linux 7.6 Extended Update Support update for patch