Description
rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | bash | 4.4-1 | — |
| Debian 13 | bash | 4.4-1 | — |
| Debian 12 | bash | 4.4-1 | — |
| Debian 8 | bash | 4.3-11+deb8u2 | DLA-1726-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | bash | 4.3-14ubuntu1.4 | USN-4058-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | bash | 4.3-7ubuntu1.8+esm1 | USN-4058-2 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | bash +1 | 4.2.46-34.el7 | RHSA-2020:1113 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.7 EUS | bash +1 | 4.2.46-34.el7_7 | RHSA-2020:3592 |
| RHEL 7.6 EUS | bash +1 | 4.2.46-32.el7_6 | RHSA-2020:3474 |
| RHEL 7.4 TUS | bash +1 | 4.2.46-30.el7_4 | RHSA-2020:3803 |
| RHEL 7.4 E4S | bash +1 | 4.2.46-30.el7_4 | RHSA-2020:3803 |
| RHEL 7.4 AUS | bash +1 | 4.2.46-30.el7_4 | RHSA-2020:3803 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-1 |
| SLES 12 SP3 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-1 |
| SLES 12 SP2 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-2 |
| SLES 12 SP1 | bash | 4.2-83.3.1 | SUSE-SU-2019:0898-1 |
| SLES 12 | bash | 4.2-83.3.1 | SUSE-SU-2019:0898-1 |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-1 |
| SLES for SAP 12 SP3 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-1 |
| SLES for SAP 12 SP2 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-2 |
| SLES for SAP 12 SP1 | bash | 4.2-83.3.1 | SUSE-SU-2019:0898-1 |
| SUSE OpenStack Cloud 7 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-2 |
| SUSE Enterprise Storage 4 | bash | 4.3-83.23.1 | SUSE-SU-2019:0838-2 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | bash +1 | 4.2.46-34.amzn2 | ALAS2-2020-1503 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | bash +1 | 4.2.46-34.el7 | ELSA-2020-1113 |
Advisories 13
- WID-SEC-2025-0227 IBM QRadar SIEM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- RHSA-2020:3803 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:3592 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:3474 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2020:1113 Red Hat Security Advisory: bash security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DLA-1726-1 bash - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4058-1 bash vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-4058-2 bash vulnerability Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2019:0838-2 Security update for bash SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0898-1 Security update for bash SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0838-1 Security update for bash SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2020-1503 Moderate: bash security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 22, 2020
- ELSA-2020-1113 Moderate: bash security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 6, 2020
References
- https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441
- http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65
- [debian-lts-announce] 20190325 [SECURITY] [DLA 1726-1] bash security update mailing-list
- openSUSE-SU-2019:1178 vendor-advisory
- https://security.netapp.com/advisory/ntap-20190411-0001/
- USN-4058-1 vendor-advisory
- USN-4058-2 vendor-advisory