Shellshock: CVE-2014-6271 in GNU Bash

Bash up to 4.3 ran commands hidden behind function definitions in environment variables.

Published in the NVD on 24/09/2014

CVE-2014-6271

CVSS 3.1: 9.8 (critical) actively exploited

In the CISA catalogue of actively exploited vulnerabilities since 28/01/2022

Exploitation probability (EPSS, 01/11/2026): 99.999 %, percentile 99.993

What is Shellshock?

Shellshock is a flaw in GNU Bash up to 4.3. Bash executed trailing commands after a function definition in the value of an environment variable. Wherever an environment variable crosses a privilege boundary into Bash, an attacker can run code, for example through CGI scripts in the Apache HTTP Server, DHCP clients or the ForceCommand feature of OpenSSH.

The NVD rates it at CVSS 9.8, and CISA has listed it as actively exploited since 28 January 2022. The first fix was incomplete; the remaining problem has its own identifier, CVE-2014-7169.

Affected and fixed versions

GNU Bash

Affected: <= 4.3

No fixed version given in the NVD data

Status in Debian and Ubuntu

Debian 12: bash

Fixed

Fixed from package version 4.3-9.1

Debian 13: bash

Fixed

Fixed from package version 4.3-9.1

Ubuntu 14.04 LTS: bash

Fixed

Fixed from package version 4.3-7ubuntu1.1

What to do

Install the bash security update of your distribution, which also covers the follow-up flaws. Debian 12 and 13 ship Bash 5.2 with the fix.

Erseni Patch tells you when a new vulnerability affects exactly your version, and when your release branch loses its support. Add the program or package with your version and we check it right away.

Watch bash (Debian 12)

Watch bash (Ubuntu 24.04 LTS)

Already have an account? Log in and add bash (Debian 12)