Skip to content
Fencer Vulns
high 7.8

CVE-2019-13638 json

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an…

published 2019-07-26 7 y ago modified 2026-07-18 3 mo ago also EUVD-2019-5066 , JLSEC-2026-17

cvss
7.8
version 3.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
4.5%
EPSS 4.5% chance of exploitation in 30 days, percentile 91%
public exploits
0
none known

Summary

GNU patch through 2.7.6 is vulnerable to OS shell command injection that can be exploited by opening a crafted patch file that contains an ed style diff payload with shell metacharacters. The ed editor does not need to be present on the vulnerable system. This is different from CVE-2018-1000156.

Patch / fix

  • julia patch_jll 2.8.0+0
  • patch Debian 14, Debian 13, Debian 12 2.7.6-5

debian advisories DEBIAN-CVE-2019-13638

  • patch Ubuntu 16.04 LTS 2.7.5-1ubuntu0.16.04.2
  • patch Ubuntu 18.04 LTS 2.7.6-2ubuntu1.1
  • patch Ubuntu Pro 14.04 LTS 2.7.1-4ubuntu2.4+esm1

ubuntu advisories UBUNTU-CVE-2019-13638

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • patch RHEL 7 2.7.1-12.el7_7
  • patch RHEL 8 2.7.6-9.el8_0
  • patch RHEL 7.4 TUS, RHEL 7.4 E4S, RHEL 7.4 AUS 2.7.1-11.el7_4
  • patch RHEL 7.5 EUS 2.7.1-11.el7_5
  • patch RHEL 7.6 EUS 2.7.1-11.el7_6

red hat advisories RHSA-2019:4061RHSA-2019:3757RHSA-2019:3758RHSA-2019:2964RHSA-2019:2798

  • patch Alpine 3.24, Alpine 3.23, Alpine 3.22 +13 more 2.7.6-r6
  • patch Alpine 3.7 2.7.6-r0
  • patch Alpine 3.8 2.7.6-r4

alpine advisories ALPINE-CVE-2019-13638

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • patch Azure Linux 3.0 2.7.6-9
  • patch CBL-Mariner 2.0 2.7.6-7

azure linux advisories AZL-35106AZL-6790

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-13638 updated cvss 7.8

patch: OS shell command injection when processing crafted patch files

  • Red Hat Enterprise Linux 5 patch
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux BaseOS (v. 8) patch 2.7.6-9.el8_0
    fixed: vendor fix RHSA-2019:2798
  • Red Hat Enterprise Linux Client (v. 7) patch 2.7.1-12.el7_7 Red Hat Enterprise Linux ComputeNode (v. 7) patch 2.7.1-12.el7_7
    fixed: vendor fix RHSA-2019:2964
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.5) patch 2.7.1-11.el7_5
    fixed: vendor fix RHSA-2019:3757
  • Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) patch 2.7.1-11.el7_6 Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) patch 2.7.1-11.el7_6
    fixed: vendor fix RHSA-2019:3758
  • Red Hat Enterprise Linux Server (v. 7) patch 2.7.1-12.el7_7
    fixed: vendor fix RHSA-2019:2964
  • Red Hat Enterprise Linux Server AUS (v. 7.4) patch 2.7.1-11.el7_4 Red Hat Enterprise Linux Server E4S (v. 7.4) patch 2.7.1-11.el7_4
    fixed: vendor fix RHSA-2019:4061
  • Red Hat Enterprise Linux Server EUS (v. 7.5) patch 2.7.1-11.el7_5
    fixed: vendor fix RHSA-2019:3757
show 4 more
  • Red Hat Enterprise Linux Server EUS (v. 7.6) patch 2.7.1-11.el7_6
    fixed: vendor fix RHSA-2019:3758
  • Red Hat Enterprise Linux Server TUS (v. 7.4) patch 2.7.1-11.el7_4
    fixed: vendor fix RHSA-2019:4061
  • Red Hat Enterprise Linux Workstation (v. 7) patch 2.7.1-12.el7_7
    fixed: vendor fix RHSA-2019:2964
  • Red Hat Enterprise Linux 6 patch
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.49% chance of exploitation in the next 30 days, higher than 91% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C
OSV 3.0 7.8 CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia patch_jll
<2.8.0+0
2.8.0+0

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.