GNU Patch Symlink Handling Vulnerability in Debian Packages
Summary
DEBIAN-CVE-2019-13636: In GNU patch through 2.7.6, the following of symlinks is mishandled in certain cases other than input files. This affects inp.c and util.c. Affects patch versions < 2.7.6-5. Fixed in 2.7.6-5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'patch' package in Debian is a utility that allows users to apply changes to files using diff files. It is widely used in software development for managing changes in source code. The package is critical for maintaining version control and ensuring that updates can be applied smoothly. However, a vulnerability has been identified in versions up to 2.7.6, which affects its handling of symbolic links, potentially leading to unintended file manipulations.
Vulnerability Detail
In GNU patch through version 2.7.6, there is a mishandling of symlinks in certain cases beyond just input files. This flaw is present in the source files inp.c and util.c, which could allow an attacker to exploit the vulnerability to manipulate files in ways that were not intended by the user. The ramifications of this vulnerability could include unauthorized access to sensitive files or the corruption of important data.
How To Fix
Minimum fixed version
2.7.6-5
This is the first release that contains the fix.
sudo apt-get install --only-upgrade patchTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using symlinks in their patch files until the package is updated. Additionally, users can manually inspect and verify the integrity of files before applying patches to ensure that no unintended changes occur.
Conclusion
The GNU patch vulnerability presents a significant risk for users of Debian packages, particularly those using versions up to 2.7.6. It is crucial for users to update their packages to the latest fixed version to mitigate potential risks. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for patch →
FAQ
The vulnerability involves mishandling of symlinks, which could lead to unauthorized file manipulations.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Update the 'patch' package to version 2.7.6-5 or later using the command 'sudo apt-get update && sudo apt-get install patch'.
While specific exploits have not been publicly disclosed, the nature of the vulnerability suggests that it could be leveraged for unauthorized access or data corruption.
Vulert is a service that monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. It provides real-time alerts for vulnerabilities without requiring code access.
References
Related vulnerabilities
Recent vulnerabilities recorded for patch.
