Critical Vulnerability in GNU Patch Package: CVE-2018-20969
Summary
ALPINE-CVE-2018-20969: do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! Affects patch versions < 2.7.6-r6. Fixed in 2.7.6-r6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GNU Patch is a widely used utility that allows users to apply changes to files and manage patches in software development. It is essential for maintaining code integrity and facilitating collaboration among developers. However, certain versions of GNU Patch are vulnerable to a specific issue that can lead to unintended command execution, making it crucial for users to be aware of this vulnerability.
Vulnerability Detail
The vulnerability identified as CVE-2018-20969 exists in the do_ed_script function within pch.c of GNU Patch versions up to 2.7.6. This flaw allows attackers to exploit strings that begin with a '!' character, which can lead to unexpected behavior and potential command execution. This issue is particularly concerning as it can compromise the integrity of the patching process, allowing malicious alterations to be applied to files, which may result in data loss or unauthorized access.
How To Fix
Minimum fixed version
2.7.6-r6
This is the first release that contains the fix.
sudo apk add --upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using patch files that contain strings beginning with a '!' character until the package is updated. This can help prevent exploitation of the vulnerability while a permanent fix is being implemented.
Conclusion
CVE-2018-20969 represents a significant vulnerability in the GNU Patch package, which can lead to serious security risks if not addressed. Users are strongly encouraged to update to the patched version to ensure the integrity and security of their systems.
See every vulnerability recorded for patch →
FAQ
CVE-2018-20969 is a vulnerability in GNU Patch that allows for exploitation through strings starting with a '!' character, potentially leading to command execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2018-20969 is 7.8, indicating a high severity level.
If an immediate update is not possible, avoid using patch files with '!' characters as a temporary workaround.
More information about GNU Patch can be found on its official website or through its documentation.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
