GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 24, 2014 |
| Apple Osx Bash | — | Upgrade macOS to the latest version | Apr 5, 2017 | Sep 24, 2014 |
| Centos_linux | — | Upgrade bashUpgrade bash-doc | Dec 1, 2016 | Sep 24, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 24, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 24, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade linux_base-c6Upgrade bash-staticUpgrade bash | Dec 10, 2025 | Sep 24, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 24, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 24, 2014 | Sep 24, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 24, 2014 |
| Oracle_linux | — | Upgrade bash-docUpgrade bash | Oct 16, 2024 | Sep 24, 2014 |
| Panos | — | Update PAN-OS 5.0 to the latest workaround for your deviceUpdate PAN-OS 6.0 to the latest workaround for your deviceUpdate PAN-OS 5.1 to the latest workaround for your deviceUpdate PAN-OS 6.1 to the latest workaround for your device | Oct 12, 2016 | Sep 24, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 7.4R13.1Update Pulse Connect Secure to version 7.1R20.1Update Pulse Connect Secure to version 8.0R7 | Oct 28, 2020 | Sep 24, 2014 |
| Redhat_linux | — | — | Jul 9, 2025 | Sep 24, 2014 |
| Suse | — | Upgrade libreadline6-32bitUpgrade readline-develUpgrade sles12-docker-imageUpgrade libreadline5-x86Upgrade readline-devel-32bitUpgrade libreadline5Upgrade bash-develUpgrade bash-langUpgrade readline-docUpgrade bash-x86Upgrade bash-docUpgrade libreadline5-32bitUpgrade libreadline6Upgrade sles12sp1-docker-imageUpgrade libreadline7Upgrade bash | Dec 18, 2015 | Sep 24, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 24, 2014 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub