{"id":"CVE-2019-13638","aliases":["ALPINE-CVE-2019-13638","AZL-35106","AZL-6790","BELL-CVE-2019-13638","DEBIAN-CVE-2019-13638","DLA-1864-1","DSA-4489-1","EUVD-2019-5066","GHSA-vqpq-8jvg-rwmx","JLSEC-2026-17","MGASA-2020-0093","RHSA-2019:2798","RHSA-2019:2964","RHSA-2019:3757","RHSA-2019:3758","RHSA-2019:4061","UBUNTU-CVE-2019-13638","USN-4071-1","USN-4071-2"],"status":"published","title":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by...","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04493,"percentile":0.91607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2019-07-22T00:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"patch","fixed_in":["2.7.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"patch","fixed_in":["2.7.6-r4"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"patch","fixed_in":["2.7.6-r6"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"patch","fixed_in":["2.7.6-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"patch","fixed_in":["2.7.6-7"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"patch","fixed_in":["2.7.6-5"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"patch","fixed_in":["2.7.6-5"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"patch","fixed_in":["2.7.6-5"],"sources":["osv"]},{"ecosystem":"Julia","package":"patch_jll","fixed_in":["2.8.0+0"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","fixed_in":["2.7.1-4ubuntu2.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"patch","fixed_in":["2.7.5-1ubuntu0.16.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"patch","fixed_in":["2.7.6-2ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-r6"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-5"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-5"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-5"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-1+deb8u3"}]}],"versions":["2.7.5-1","2.7.5-1+deb8u1","2.7.5-1+deb8u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:9","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-1+deb9u2"}]}],"versions":["2.7.5-1","2.7.5-1+deb9u1"],"bundled":3},{"source":"osv","ecosystem":"Debian:10","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-3+deb10u1"}]}],"versions":["2.7.6-3"],"bundled":3},{"source":"osv","ecosystem":"Julia","package":"patch_jll","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.0+0"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-4.1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-9.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-9.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::baseos","package":"patch-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.6-9.el8_0"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-12.el7_7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::computenode","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.5::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_5"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"patch-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.7.1-11.el7_4"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-4ubuntu2.4+esm1"}]}],"versions":["2.7.1-3","2.7.1-4","2.7.1-4ubuntu1","2.7.1-4ubuntu2","2.7.1-4ubuntu2.3","2.7.1-4ubuntu2.4"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-1ubuntu0.16.04.2"}]}],"versions":["2.7.5-1","2.7.5-1ubuntu0.16.04.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-2ubuntu1.1"}]}],"versions":["2.7.5-1build1","2.7.6-1","2.7.6-2ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.5-1ubuntu0.16.04.2"}]}],"versions":["2.7.5-1","2.7.5-1ubuntu0.16.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.6-2ubuntu1.1"}]}],"versions":["2.7.5-1build1","2.7.6-1","2.7.6-2ubuntu1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"patch","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.1-4ubuntu2.4+esm1"}]}],"versions":["2.7.1-3","2.7.1-4","2.7.1-4ubuntu1","2.7.1-4ubuntu2","2.7.1-4ubuntu2.3","2.7.1-4ubuntu2.4"],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"patch"}],"references":[{"url":"https://security-tracker.debian.org/tracker/CVE-2019-13638","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0","tags":["x_refsource_MISC","x_transferred","Mailing List","Patch","Vendor Advisory","fix","web"]},{"url":"https://www.debian.org/security/2019/dsa-4489","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Jul/54","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://seclists.org/bugtraq/2019/Aug/29","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web","article"]},{"url":"http://packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/201908-22","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190828-0001/","tags":["x_refsource_CONFIRM","x_transferred","advisory","web"]},{"url":"https://github.com/irsl/gnu-patch-vulnerabilities","tags":["x_refsource_MISC","x_transferred","package","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2798","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:2964","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3757","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3758","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4061","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-13638","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT"},{"url":"https://security.netapp.com/advisory/ntap-20190828-0001"},{"url":"https://github.com/advisories/GHSA-vqpq-8jvg-rwmx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-13638","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-13638","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0093.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25279","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/SVWWGISFWACROJJPVJJL4UBLVZ7LPOLT/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1733916","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1746672","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2798.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-20969","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-20969","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20969","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-13638","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-13638","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2964.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3757.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3758.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4061.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13638","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4071-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4071-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-13636","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T12:22:43Z","modified":"2024-08-04T23:57:39.539Z","updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-5066","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T12:22:43Z","modified":"2024-08-04T23:57:39Z","updated_at":"2026-11-03T02:40:42.016311Z"}],"ghsa":[{"id":"GHSA-vqpq-8jvg-rwmx","title":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by...","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2022-05-24T16:51:30Z","modified":"2024-04-04T01:23:19Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:55:57.831324Z"}],"nvd":[{"id":"CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12.783Z","modified":"2026-06-17T02:17:07.817Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"ALPINE-CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12.783Z","modified":"2026-09-21T06:17:52.482440306Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:47.663013Z"},{"id":"AZL-35106","title":"CVE-2019-13638 affecting package patch for versions less than 2.7.6-9","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"AZL-6790","title":"CVE-2019-13638 affecting package patch for versions less than 2.7.6-7","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12Z","modified":"2026-04-21T04:38:17.519082Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.630357Z"},{"id":"BELL-CVE-2019-13638","title":"CVE-2019-13638 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:15:12.981471Z","modified":"2026-01-26T09:48:58.135211Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12.783Z","modified":"2026-11-01T02:45:15.462145835Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-26T13:15:12.783Z","modified":"2026-09-21T07:01:31.492541972Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"JLSEC-2026-17","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2026-03-31T16:50:26.988Z","modified":"2026-07-18T00:01:36.349903603Z","cvss":[{"version":"2.0","score":9.3,"vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","level":"critical"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:47:18.159338Z"},{"id":"RHSA-2019:2798","title":"Red Hat Security Advisory: patch security update","status":"published","published":"2024-09-16T02:53:30Z","modified":"2025-11-22T11:48:12Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:2964","title":"Red Hat Security Advisory: patch security update","status":"published","published":"2024-09-16T02:53:37Z","modified":"2026-06-26T10:44:09Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3757","title":"Red Hat Security Advisory: patch security update","status":"published","published":"2024-09-16T02:53:48Z","modified":"2026-06-26T10:44:52Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:3758","title":"Red Hat Security Advisory: patch security update","status":"published","published":"2024-09-16T02:53:42Z","modified":"2026-06-26T10:44:52Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4061","title":"Red Hat Security Advisory: patch security update","status":"published","published":"2024-09-16T02:53:53Z","modified":"2025-11-22T11:52:18Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"UBUNTU-CVE-2019-13638","description":"GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.","status":"published","published":"2019-07-22T00:00:00Z","modified":"2026-02-04T03:46:55.102687Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"DLA-1864-1","title":"patch - security update","status":"published","published":"2019-07-25T00:00:00Z","modified":"2026-03-09T01:22:12.902669Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4489-1","title":"patch - security update","status":"published","published":"2019-07-27T00:00:00Z","modified":"2026-03-09T02:10:38.709491Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2020-0093","title":"Updated patch packages fix security vulnerabilities","description":"Updated patch package fixes security vulnerabilities:\n\n* In GNU patch through 2.7.6, the following of symlinks is mishandled\n  in certain cases other than input files. (CVE-2019-13636).\n\n* A vulnerability was found in GNU patch through 2.7.6 is vulnerable to\n  OS shell command injection that can be exploited by opening a crafted\n  patch file that contains an ed style diff payload with shell\n  metacharacters (CVE-2019-13638).\n\n* A vulnerability was found in do_ed_script in pch.c in GNU patch through\n  2.7.6 does not block strings beginning with a ! character. NOTE: this\n is the same commit as for CVE-2019-13638, but the ! syntax is specific to\n  ed, and is unrelated to a shell metacharacter (CVE-2018-20969).\n","status":"published","published":"2020-02-21T23:06:01Z","modified":"2026-04-16T04:42:03.302682619Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"USN-4071-1","title":"patch vulnerabilities","description":"It was discovered that Patch incorrectly handled certain files.\nAn attacker could possibly use this issue to access sensitive information.\n(CVE-2019-13636)\n\nIt was discovered that Patch incorrectly handled certain files.\nAn attacker could possibly use this issue to execute arbitrary code.\n(CVE-2019-13638)\n","status":"published","published":"2019-07-24T13:33:20Z","modified":"2026-02-10T04:41:35Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4071-2","title":"patch vulnerabilities","description":"USN-4071-1 fixed several vulnerabilities in Patch. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Patch incorrectly handled certain files.\n An attacker could possibly use this issue to access sensitive information.\n (CVE-2019-13636)\n\n It was discovered that Patch incorrectly handled certain files.\n An attacker could possibly use this issue to execute arbitrary code.\n (CVE-2019-13638)\n","status":"published","published":"2019-07-24T15:15:59Z","modified":"2026-02-10T04:41:35Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}