GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade bash | Aug 30, 2017 | Sep 24, 2014 |
| Apple Osx Bash | — | Upgrade macOS to the latest version | Apr 5, 2017 | Sep 24, 2014 |
| Centos_linux | — | Upgrade bash-docUpgrade bash | Dec 1, 2016 | Sep 24, 2014 |
| Cisco Ise | — | — | Oct 21, 2025 | Sep 26, 2014 |
| Cisco Xe | — | Upgrade to the latest version of Cisco IOS XE | Jul 30, 2019 | Sep 24, 2014 |
| Debian | — | Upgrade bash | Jul 30, 2024 | Sep 24, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | May 22, 2015 |
| Freebsd | — | Upgrade bashUpgrade bash-staticUpgrade linux_base-c6 | Dec 10, 2025 | Sep 24, 2014 |
| Gentoo Linux | — | Upgrade app-shells/bash. | Oct 30, 2017 | Sep 24, 2014 |
| Gnu Bash | — | Upgrade to the latest version of GNU bash | Sep 24, 2014 | Sep 24, 2014 |
| Oracle Solaris | — | Upgrade shell/bash to version 4.1.17-0.175.2.5.0.2.0 on Solaris 11.2 | May 29, 2017 | Sep 24, 2014 |
| Oracle_linux | — | Upgrade bash-docUpgrade bash | Oct 16, 2024 | Sep 24, 2014 |
| Panos | — | Update PAN-OS 6.0 to the latest workaround for your deviceUpdate PAN-OS 5.1 to the latest workaround for your deviceUpdate PAN-OS 6.1 to the latest workaround for your deviceUpdate PAN-OS 5.0 to the latest workaround for your device | Oct 12, 2016 | Sep 24, 2014 |
| Pulse Secure Pulse Connect Secure | — | Update Pulse Connect Secure to version 7.1R20.1Update Pulse Connect Secure to version 8.0R7Update Pulse Connect Secure to version 7.4R13.1 | Oct 28, 2020 | Sep 24, 2014 |
| Redhat_linux | — | — | Jul 9, 2025 | Sep 24, 2014 |
| Suse | — | Upgrade libreadline6Upgrade readline-docUpgrade bash-docUpgrade sles12sp1-docker-imageUpgrade bash-x86Upgrade libreadline5-32bitUpgrade bashUpgrade libreadline7Upgrade libreadline6-32bitUpgrade readline-develUpgrade bash-develUpgrade libreadline5Upgrade bash-langUpgrade readline-devel-32bitUpgrade libreadline5-x86Upgrade sles12-docker-image | Dec 18, 2015 | Sep 24, 2014 |
| Ubuntu | — | Upgrade bash | Nov 8, 2024 | Sep 24, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub