Command Injection Vulnerability in GNU Patch by GNU Project

CVE-2018-20969

Summary

The command injection vulnerability in GNU Patch allows attackers to exploit input strings beginning with a '!' character. This issue affects versions up to 2.7.6, where the handling of the 'ed' command syntax creates a potential for unauthorized command execution. As the vulnerability is tied to the use of specific characters that bypass normal controls, it is crucial for users and administrators to ensure they are using updated and patched versions to mitigate the risk of exploitation.

References