CVE-2014-6278
GNU Bash OS Command Injection Vulnerability
Does this matter?
Known to be exploited in the wild (CISA KEV, CISA remediation deadline 23 October 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.
Description
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 99.52% probability · 100th percentile
- CISA KEV
- Listed 2 October 2025 · due 23 October 2025
- Weakness
- CWE-78
- Affected
- gnu/bash
- Source
- security@debian.org
CISA notes
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability could affect an open-source component, third-party library, protocol, or proprietary implementation that could be used by different products. For more information, please see: http://ftp.gnu.org/gnu/bash/bash-4.3-patches/bash43-027 ; https://support.broadcom.com/web/ecx/support-content-notification/-/external/content/SecurityAdvisories/0/23467 ; https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140926-bash ; https://www.ibm.com/support/pages/security-bulletin-update-vulnerabilities-bash-affect-aix-toolbox-linux-applications-cve-2014-6271-cve-2014-6277-cve-2014-6278-cve-2014-7169-cve-2014-7186-and-cve-2014-7187 ; https://nvd.nist.gov/vuln/detail/CVE-2014-6278
References
- http://jvn.jp/en/jp/JVN55667175/index.htmlThird Party Advisory
- http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126Third Party Advisory
- http://lcamtuf.blogspot.com/2014/09/bash-bug-apply-unofficial-patch-now.htmlPatch, Third Party Advisory
- http://lcamtuf.blogspot.com/2014/10/bash-bug-how-we-finally-cracked.htmlThird Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3093Third Party Advisory
- http://linux.oracle.com/errata/ELSA-2014-3094Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00004.htmlMailing List
- http://lists.opensuse.org/opensuse-updates/2014-10/msg00025.htmlMailing List
- http://marc.info/?l=bugtraq&m=141330468527613&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141345648114150&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383026420882&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383081521087&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383196021590&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383244821813&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383304022067&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383353622268&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141383465822787&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141450491804793&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141576728022234&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141577137423233&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141577241923505&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141577297623641&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141585637922673&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=141879528318582&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=142118135300698&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=142358026505815&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=142358078406056&w=2Third Party Advisory
- http://marc.info/?l=bugtraq&m=142721162228379&w=2Third Party Advisory
- http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.htmlThird Party Advisory
- http://packetstormsecurity.com/files/137344/Sun-Secure-Global-Desktop-Oracle-Global-Desktop-Shellshock.htmlThird Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.