Description
The redirection implementation in parse.y in GNU Bash through 4.3 bash43-026 allows remote attackers to cause a denial of service (out-of-bounds array access and application crash) or possibly have unspecified other impact via crafted use of here documents, aka the "redir_stack" issue.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bash | 4.3-9.2 | — |
| Debian 13 | bash | 4.3-9.2 | — |
| Debian 12 | bash | 4.3-9.2 | — |
| Debian 7 | bash | 4.2+dfsg-0.1+deb7u3 | DSA-3035-1 |
| Debian 6.0 | bash | 4.1-3+deb6u2 | DLA-63-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | bash | 4.3-7ubuntu1.4 | USN-2364-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | bash +1 | 4.2.45-5.el7_0.4 | RHSA-2014:1306 |
| RHEL 6 | bash +1 | 4.1.2-15.el6_5.2 | RHSA-2014:1306 |
| RHEL 5 | bash | 3.2-33.el5_11.4 | RHSA-2014:1306 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 3 | rhev-hypervisor6 | 6.5-20140930.1.el6ev | RHSA-2014:1354 |
| Red Hat Rhel Sjis 6 | bash +1 | 4.1.2-15.el6_5.1.sjis.2 | RHSA-2014:1312 |
| Red Hat Rhel Sjis 5 | bash | 3.2-32.el5_9.3.sjis.1 | RHSA-2014:1865, RHSA-2014:1312 |
| Red Hat Rhel Mission Critical 6 | bash +1 | 4.1.2-9.el6_2.2 | RHSA-2014:1311 |
| Red Hat Rhel Mission Critical 5 | bash | 3.2-24.el5_6.2 | RHSA-2014:1311 |
| RHEL 6.4 EUS | bash +1 | 4.1.2-15.el6_4.2 | RHSA-2014:1311 |
| RHEL 5.9 EUS | bash | 3.2-32.el5_9.3 | RHSA-2014:1311 |
| RHEL 4 ELS | bash | 3.0-27.el4.4 | RHSA-2014:1311 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | bash | 7.0-92.1 | openSUSE-SU-2024:10106-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | bash +1 | 4.2.45-5.el7_0.4 | ELSA-2014-1306 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- GNU bash 4.3.11 - Environment Variable dhclient EDB-34860 · remote · Oct 2, 2014
- dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock) EDB-36933 · remote · Sep 29, 2014 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 10
- RHSA-2014:1354 Red Hat Security Advisory: rhev-hypervisor6 security update Red Hat Security Advisories (RHSA) · Jul 29, 2026
- RHSA-2014:1865 Red Hat Security Advisory: bash Shift_JIS security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1312 Red Hat Security Advisory: bash Shift_JIS security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1311 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2014:1306 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DLA-63-1 bash - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-3035-1 bash - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-2364-1 bash vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- openSUSE-SU-2024:10106-1 bash-4.4-92.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-1306 Important: bash security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Sep 25, 2014
References
- http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004897
- http://www-01.ibm.com/support/docview.wss?uid=swg21685749
- HPSBMU03165 vendor-advisory
- https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102673&src=securityAlerts
- HPSBST03131 vendor-advisory
- SSRT101819 vendor-advisory
- 20141001 NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities mailing-list
- HPSBMU03245 vendor-advisory
- openSUSE-SU-2014:1229 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686084
- http://www-01.ibm.com/support/docview.wss?uid=swg21686479
- 61188 third-party-advisory
- JVN#55667175 third-party-advisory
- openSUSE-SU-2014:1254 vendor-advisory
- 60433 third-party-advisory
- [oss-security] 20140925 Fwd: Non-upstream patches for bash mailing-list
- HPSBMU03143 vendor-advisory
- HPSBMU03182 vendor-advisory
- HPSBST03155 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685541
- http://www.oracle.com/technetwork/topics/security/bashcve-2014-7169-2317675.html
- 61636 third-party-advisory
- 61816 third-party-advisory
- 61442 third-party-advisory
- HPSBMU03246 vendor-advisory
- 61283 third-party-advisory
- SSRT101711 vendor-advisory
- APPLE-SA-2015-09-30-3 vendor-advisory
- https://kc.mcafee.com/corporate/index?page=content&id=SB10085
- 61654 third-party-advisory
- http://www-947.ibm.com/support/entry/portal/docdisplay?lndocid=MIGR-5096315
- 62312 third-party-advisory
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15629.html
- HPSBMU03217 vendor-advisory
- RHSA-2014:1312 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21685604
- SSRT101868 vendor-advisory
- 61703 third-party-advisory
- USN-2364-1 vendor-advisory
- 61065 third-party-advisory
- HPSBST03129 vendor-advisory
- HPSBMU03144 vendor-advisory
- http://www-01.ibm.com/support/docview.wss?uid=swg21686445
- http://www-01.ibm.com/support/docview.wss?uid=swg21686131
- JVNDB-2014-000126 third-party-advisory
- 61641 third-party-advisory
- SUSE-SU-2014:1247 vendor-advisory
- https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10648
- http://www-01.ibm.com/support/docview.wss?uid=ssg1S1004898
- http://www-01.ibm.com/support/docview.wss?uid=swg21685914
- 20141001 FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities mailing-list
- MDVSA-2015:164 vendor-advisory
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-c04497075
- https://support.apple.com/HT205267
- 60024 third-party-advisory
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html
- 61622 third-party-advisory
- 20140926 GNU Bash Environment Variable Command Injection Vulnerability vendor-advisory
- http://support.novell.com/security/cve/CVE-2014-7186.html