projects / openwrt / staging / 981213.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: c99ceb7) | patch
tools/patch: apply upstream patch for cve-2019-13638
authorRussell Senior <russell@personaltelco.net>
Sun, 11 Aug 2019 20:57:08 +0000 (13:57 -0700)
committerPetr Štetiar <ynezz@true.cz>
Wed, 14 Aug 2019 07:12:23 +0000 (09:12 +0200)
commitdc2f2a16d385147abf8bc13b0b05ab0f2512b537
treee12b29fb5549484fedc65ed499594051458533f3tree | snapshot
parentc99ceb7030ed92926d6e3561b176cb9940daa3cbcommit | diff
tools/patch: apply upstream patch for cve-2019-13638

GNU patch through 2.7.6 is vulnerable to OS shell command injection that
can be exploited by opening a crafted patch file that contains an ed style

diff payload with shell metacharacters. The ed editor does not need to be
present on the vulnerable system. This is different from CVE-2018-1000156.

https://nvd.nist.gov/vuln/detail/CVE-2019-13638

Signed-off-by: Russell Senior <russell@personaltelco.net>
(cherry picked from commit bcfd1d76852974170780dbe368e6194dbb0e123e)
tools/patch/Makefile diff | blob | history
tools/patch/patches/060-CVE-2019-13638.patch [new file with mode: 0644] blob
Staging tree of Chuanhong Guo