CVE-2018-20969: gnu patch OS Command Injection
CVSS: 9.3v2.0HighModified
AliasesALPINE-CVE-2018-20969UBUNTU-CVE-2018-20969DEBIAN-CVE-2018-20969CGA-7vwc-h6mq-fvr4CGA-gf54-63hr-xx5x
Published 16-08-2019Last modified 05-08-2024
Vulnerability summary
CVE-2018-20969 is a high (CVSS 9.3) OS Command Injection vulnerability in gnu patch. EPSS estimates a 2.68% chance of exploitation in the next 30 days, higher than 85.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
9.3/10
010
High · v2.0 (NVD)EPSS score
2.68%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 8 · Related 4Timeline
- 16-08-2019PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
do_ed_script in pch.c in GNU patch through 2.7.6 does not block strings beginning with a ! character. NOTE: this is the same commit as for CVE-2019-13638, but the ! syntax is specific to ed, and is unrelated to a shell metacharacter.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSourcesAll 6 agree
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · WolfiEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · ChainguardEcosystem advisory · calculated7.8HighCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
High 9.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
2.68%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.68% on 19-09-2026
19-09-202619-10-2026
EPSS score2.68%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (seclists.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Alpine1 product
- patch< 2.7.6-r6
Chainguard1 product
- patch< 2.7.6-r3
Debian1 product
- patch< 2.7.6-5
Gnu1 product
- patch≤ 2.7.6
Ubuntu1 product
- patch< 2.7.1-4ubuntu2.4+esm1 | < 2.7.5-1ubuntu0.16.04.2 | < 2.7.6-2ubuntu1.1
Wolfi1 product
- patch< 2.7.6-r3
6 vendors · 6 products
References
16 links- git.savannah.gnu.org/cgit/patch.git/commit/?id=3fcd042d26d70856e826a42b5f93dc4854d80bf0X Refsource MISCPatchVendor AdvisoryFIX
- packetstormsecurity.com/files/154124/GNU-patch-Command-Injection-Directory-Traversal.htmlX Refsource MISCThird Party AdvisoryVDB EntryAdvisory
