Summary
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.
- Vendor
- GNU
- Product
- Bourne-Again Shell (Bash)
- Added to KEV
- Jan 28, 2022
- Remediation due
- Jul 28, 2022 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-78
- EPSS
- 99.9% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References