Exploited in the wild · bash · CVSS 9.8 · published 24 September 2014
Shellshock: CVE-2014-6271
Bash ran commands placed after function definitions in environment variables, so any service that passes outside input to bash, such as a CGI script, could be made to run code. Below is its status on each Linux distribution past end of life, from the vendors' own security trackers.
- 0end-of-life systems without a free fix
- 9fixed or not affected
Shellshock on end-of-life Linux
| Distribution | Status | Details |
|---|---|---|
| CentOS 6 | Fixed | bash 4.1.2-15.el6_5.1, 24 September 2014 |
| CentOS 7 | Fixed | bash 4.2.45-5.el7_0.2, 24 September 2014 |
| RHEL 7 | Fixed | bash 4.2.45-5.el7_0.2, 24 September 2014 |
| CentOS 8 | Fixed before release | published before RHEL 8 shipped |
| Ubuntu 16.04 | Fixed before release | published before this release shipped |
| Ubuntu 18.04 | Fixed before release | published before this release shipped |
| Ubuntu 20.04 | Fixed before release | published before this release shipped |
| Debian 10 | Fixed before release | published before this release shipped |
| Debian 11 | Fixed before release | published before this release shipped |
From the Red Hat security data (CentOS and RHEL), the Ubuntu CVE tracker and the Debian security tracker, 29 October 2026. CentOS received Red Hat's fixes only until its own end of life; later fixes went to paid Red Hat support. Fixes marked Ubuntu Pro need a paid subscription. Where a tracker has no entry, the version in the distribution's repository is checked against the NVD range.
What the NVD record says
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.
Score 9.8 (Critical), published 24 September 2014. Listed in the CISA catalogue of known exploited vulnerabilities on 28 January 2022. Read the NVD entry
Affected upstream versions of bash
- bash up to 4.3
What you can do
Keep bash, patched
Where the table shows no free fix, we backport it to the package you run, built and tested before delivery. A fix for a new vulnerability arrives within 48 hours of your order, or within 24 hours with priority delivery.
Upgrade
Move to a supported release once your applications can make the jump. Our fixes keep you safe while you plan it.
Assess first
Our assessment shows which vulnerabilities are real on your servers, what else is past end of life, and the remediation plan.