Critical Input Validation Vulnerability in GNU Patch Package
Summary
DEBIAN-CVE-2018-1000156: GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution. Affects patch versions < 2.7.6-2. Fixed in 2.7.6-2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
GNU Patch is a widely used utility that allows users to apply changes to files based on a patch file. It is essential for developers and system administrators to manage code changes efficiently. The package is known for its ability to handle patch files generated by the diff utility, making it a crucial tool in software development and maintenance. However, a recent vulnerability has been identified that compromises its security, specifically in the way it processes patch files.
Vulnerability Detail
GNU Patch version 2.7.6 contains an input validation vulnerability that arises during the processing of patch files. The vulnerability is related to the invocation of EDITOR_PROGRAM, which uses the 'ed' editor. This flaw can potentially lead to arbitrary code execution when a malicious patch file is processed by the patch utility. This vulnerability is similar to FreeBSD's CVE-2015-1418, but the code bases have diverged, leading to unique implications for GNU Patch users.
How To Fix
Minimum fixed version
2.7.6-2
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid processing untrusted patch files or ensure that the EDITOR_PROGRAM is set to a safe editor that does not allow for arbitrary code execution. Additionally, users can manually inspect patch files before applying them to ensure they do not contain malicious code.
Conclusion
The identified vulnerability in GNU Patch poses a significant risk to users who process patch files without proper safeguards. It is crucial to update to the patched version to mitigate the risk of arbitrary code execution. Users are encouraged to remain vigilant and utilize tools like Vulert to monitor for vulnerabilities in their software.
See every vulnerability recorded for patch →
FAQ
The vulnerability is an input validation issue that can lead to arbitrary code execution when processing malicious patch files.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Failure to address this vulnerability could allow attackers to execute arbitrary code on your system, potentially leading to data breaches or system compromise.
Yes, version 2.7.6-2 and later are patched versions that address this vulnerability.
If immediate updates are not possible, avoid using untrusted patch files and consider setting a safe editor for the EDITOR_PROGRAM environment variable.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
