Red Hat Product Errata RHSA-2018:1200 - Security Advisory

Issued:: 2018-04-23
Updated:: 2018-04-23

RHSA-2018:1200 - Security Advisory

Overview
Updated Packages

Synopsis

Important: patch security update

Type/Severity

Security Advisory: Important

Topic

An update for patch is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the changes to their original file (patching the file).

Patch should be installed because it is a common way of upgrading applications.

Security Fix(es):

patch: Malicious patch files cause ed to execute arbitrary commands (CVE-2018-1000156)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Enterprise Linux Server 7 x86_64
Red Hat Enterprise Linux Server - Extended Update Support 7.6 x86_64
Red Hat Enterprise Linux Server - Extended Update Support 7.5 x86_64
Red Hat Enterprise Linux Workstation 7 x86_64
Red Hat Enterprise Linux Desktop 7 x86_64
Red Hat Enterprise Linux for IBM z Systems 7 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
Red Hat Enterprise Linux for Power, big endian 7 ppc64
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
Red Hat Enterprise Linux for Scientific Computing 7 x86_64
Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
Red Hat Enterprise Linux Server - AUS 7.6 x86_64
Red Hat Enterprise Linux for Power, little endian 7 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
Red Hat Enterprise Linux Server - TUS 7.6 x86_64
Red Hat Enterprise Linux for ARM 64 7 aarch64
Red Hat Enterprise Linux for Power 9 7 ppc64le
Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6 ppc64le
Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64
Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x

Fixes

BZ - 1564326 - CVE-2018-1000156 patch: Malicious patch files cause ed to execute arbitrary commands

CVEs

CVE-2018-1000156

References

https://access.redhat.com/security/updates/classification/#important

Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Enterprise Linux Server 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux Server - Extended Update Support 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux Server - Extended Update Support 7.5

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux Server - AUS 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux Workstation 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux Desktop 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux for IBM z Systems 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
s390x
patch-2.7.1-10.el7_5.s390x.rpm	SHA-256: 62cdf313634bc2fd8eb818e0cb196783f92d0cd3053699ab6c93f287a876ecbd
patch-debuginfo-2.7.1-10.el7_5.s390x.rpm	SHA-256: 15841f838dbce33920b2d93c3200972e2752c7919287dde35831c34ec9ec3b9b

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
s390x
patch-2.7.1-10.el7_5.s390x.rpm	SHA-256: 62cdf313634bc2fd8eb818e0cb196783f92d0cd3053699ab6c93f287a876ecbd
patch-debuginfo-2.7.1-10.el7_5.s390x.rpm	SHA-256: 15841f838dbce33920b2d93c3200972e2752c7919287dde35831c34ec9ec3b9b

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
s390x
patch-2.7.1-10.el7_5.s390x.rpm	SHA-256: 62cdf313634bc2fd8eb818e0cb196783f92d0cd3053699ab6c93f287a876ecbd
patch-debuginfo-2.7.1-10.el7_5.s390x.rpm	SHA-256: 15841f838dbce33920b2d93c3200972e2752c7919287dde35831c34ec9ec3b9b

Red Hat Enterprise Linux for Power, big endian 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64
patch-2.7.1-10.el7_5.ppc64.rpm	SHA-256: e34d092dff69ad6da56ff11c3344a8fd7d391c9ea63afd3d302d868b8b58276e
patch-debuginfo-2.7.1-10.el7_5.ppc64.rpm	SHA-256: 915c2a7730c8bcfea3d0c1f7c44deccbe38bf2a32b744586d32659fc83852fde

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64
patch-2.7.1-10.el7_5.ppc64.rpm	SHA-256: e34d092dff69ad6da56ff11c3344a8fd7d391c9ea63afd3d302d868b8b58276e
patch-debuginfo-2.7.1-10.el7_5.ppc64.rpm	SHA-256: 915c2a7730c8bcfea3d0c1f7c44deccbe38bf2a32b744586d32659fc83852fde

Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64
patch-2.7.1-10.el7_5.ppc64.rpm	SHA-256: e34d092dff69ad6da56ff11c3344a8fd7d391c9ea63afd3d302d868b8b58276e
patch-debuginfo-2.7.1-10.el7_5.ppc64.rpm	SHA-256: 915c2a7730c8bcfea3d0c1f7c44deccbe38bf2a32b744586d32659fc83852fde

Red Hat Enterprise Linux for Scientific Computing 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux EUS Compute Node 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux EUS Compute Node 7.5

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux for Power, little endian 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64le
patch-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: e1fe93ed3272b07e9b914f653f0a7250881355f1f8c76ec9e5d8e184781f2b22
patch-debuginfo-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: 9a34fa99b215f1cdcbc0099a979c2b66fc70d6374ae9f0878d2adf8674bd472a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64le
patch-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: e1fe93ed3272b07e9b914f653f0a7250881355f1f8c76ec9e5d8e184781f2b22
patch-debuginfo-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: 9a34fa99b215f1cdcbc0099a979c2b66fc70d6374ae9f0878d2adf8674bd472a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64le
patch-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: e1fe93ed3272b07e9b914f653f0a7250881355f1f8c76ec9e5d8e184781f2b22
patch-debuginfo-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: 9a34fa99b215f1cdcbc0099a979c2b66fc70d6374ae9f0878d2adf8674bd472a

Red Hat Enterprise Linux Server - TUS 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux for ARM 64 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
aarch64
patch-2.7.1-10.el7_5.aarch64.rpm	SHA-256: b508f790497269c383ffb2b5dd1f8044b511e14ca3b87de6c4a28d668ac632db
patch-debuginfo-2.7.1-10.el7_5.aarch64.rpm	SHA-256: f516b69d054c501676ef77b09226cf45b80f620088d1df37cd9946b6115f7713

Red Hat Enterprise Linux for Power 9 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64le
patch-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: e1fe93ed3272b07e9b914f653f0a7250881355f1f8c76ec9e5d8e184781f2b22
patch-debuginfo-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: 9a34fa99b215f1cdcbc0099a979c2b66fc70d6374ae9f0878d2adf8674bd472a

Red Hat Enterprise Linux Server (for IBM Power LE) - Update Services for SAP Solutions 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
ppc64le
patch-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: e1fe93ed3272b07e9b914f653f0a7250881355f1f8c76ec9e5d8e184781f2b22
patch-debuginfo-2.7.1-10.el7_5.ppc64le.rpm	SHA-256: 9a34fa99b215f1cdcbc0099a979c2b66fc70d6374ae9f0878d2adf8674bd472a

Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
x86_64
patch-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 7cf532af065d8654daec759dd23f037048cf1b0c9899dcca12cd6a128ab95d68
patch-debuginfo-2.7.1-10.el7_5.x86_64.rpm	SHA-256: 528cced06952dbe24048e577074be9ad8abc248140f39980a9cbb8d16ece385c

Red Hat Enterprise Linux for IBM System z (Structure A) 7

SRPM
patch-2.7.1-10.el7_5.src.rpm	SHA-256: a9a1c3a232cc8fac8216261262d4139fa7406323b20c0d8c5f85cff4a1285b49
s390x
patch-2.7.1-10.el7_5.s390x.rpm	SHA-256: 62cdf313634bc2fd8eb818e0cb196783f92d0cd3053699ab6c93f287a876ecbd
patch-debuginfo-2.7.1-10.el7_5.s390x.rpm	SHA-256: 15841f838dbce33920b2d93c3200972e2752c7919287dde35831c34ec9ec3b9b

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.