Skip to content
OpenAdvisories
Critical · 9.8 Known exploited Scanner template Public exploit CVE-2014-6271 EUVD-2014-6157GHSA-6hfc-grwp-2p9c

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote atta…

Published Sep 24, 2014 · Updated Oct 22, 2025 · Assigned by debian

Package: bash Package: bash Ecosystem: Debian Ecosystem: Ubuntu

Description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 bash 4.3-9.1 —
Debian 13 bash 4.3-9.1 —
Debian 12 bash 4.3-9.1 —
Debian 7 bash 4.2+dfsg-0.1+deb7u1 DSA-3032-1
Debian 6.0 bash 4.1-3+deb6u1 DLA-59-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 14.04 LTS bash 4.3-7ubuntu1.1 USN-2362-1

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
RHEL 7 bash +1 4.2.45-5.el7_0.2 RHSA-2014:1293
RHEL 6 bash +1 4.1.2-15.el6_5.1 RHSA-2014:1293
RHEL 5 bash 3.2-33.el5.1 RHSA-2014:1293
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Rhev Manager 3 rhev-hypervisor6 6.5-20140930.1.el6ev RHSA-2014:1354
Red Hat Rhel Sjis 6 bash +1 4.1.2-15.el6_5.1.sjis.1 RHSA-2014:1295
Red Hat Rhel Sjis 5 bash 3.2-33.el5_11.1.sjis.1 RHSA-2014:1295
Red Hat Rhel Mission Critical 6 bash +1 4.1.2-9.el6_2.1 RHSA-2014:1294
Red Hat Rhel Mission Critical 5 bash 3.2-24.el5_6.1 RHSA-2014:1294
RHEL 6.4 EUS bash +1 4.1.2-15.el6_4.1 RHSA-2014:1294
RHEL 5.9 EUS bash 3.2-32.el5_9.2 RHSA-2014:1294
RHEL 4 ELS bash 3.0-27.el4.2 RHSA-2014:1294

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed bash 7.0-92.1 openSUSE-SU-2024:10106-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 bash +1 4.2.45-5.el7_0.2 ELSA-2014-1293

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 10 modules

Exploit-DB 21

GitHub 96 repositories · most starred shown

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 11

References