ALSA-2020:1852 - Moderate: patch security and bug fix update
Summary
ALSA-2020:1852: Moderate: patch security and bug fix update. Affects patch versions < 2.7.6-11.el8. Fixed in 2.7.6-11.el8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The patch program is a utility used to apply diff files to original files. It compares an original file to a changed file and lists the changes made. By using the patch command with the diff file, the changes can be added to the original file. The patch program is commonly used for software updates and bug fixes.
Vulnerability Detail
The vulnerability in the patch program (CVE-2019-13636) is related to the mishandling of symlinks in inp.c and util.c files. This vulnerability occurs when following symlinks in cases other than input files. The impact of this vulnerability can vary depending on the specific use case, but it could potentially lead to unauthorized access or other security issues.
How To Fix
Minimum fixed version
2.7.6-11.el8
This is the first release that contains the fix.
sudo dnf update patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the patch program to the latest version.
Conclusion
The patch program has a vulnerability related to symlink mishandling, which can potentially lead to unauthorized access or other security issues. To mitigate this vulnerability, it is important to update the patch program to version 2.7.6-11.el8 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for patch →
FAQ
The patch program is a utility used to apply diff files to original files. It compares an original file to a changed file and lists the changes made. It is commonly used for software updates and bug fixes.
The impact of this vulnerability can vary depending on the specific use case, but it could potentially lead to unauthorized access or other security issues.
To fix this vulnerability, it is recommended to update the patch program to version 2.7.6-11.el8 or later. This update includes the necessary security patches and bug fixes to address the symlink mishandling issue.
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the patch program to the latest version.
For more information about this vulnerability, including the impact, CVSS score, acknowledgments, and related information, refer to the CVE page(s) listed in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
