{"cve":"CVE-2014-7169","nvd":{"published":"2014-09-25T01:55:04.367","modified":"2026-06-17T00:14:28.143","status":"Analyzed","description":"GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-78"],"references":["http://advisories.mageia.org/MGASA-2014-0393.html","http://archives.neohapsis.com/archives/bugtraq/2014-10/0101.html","http://jvn.jp/en/jp/JVN55667175/index.html","http://jvndb.jvn.jp/jvndb/JVNDB-2014-000126","http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html"],"products":["apple:mac_os_x","arista:eos","canonical:ubuntu_linux","checkpoint:security_gateway","citrix:netscaler_sdx_firmware","debian:debian_linux","f5:arx_firmware","f5:big-ip_access_policy_manager","f5:big-ip_advanced_firewall_manager","f5:big-ip_analytics","f5:big-ip_application_acceleration_manager","f5:big-ip_application_security_manager","f5:big-ip_edge_gateway","f5:big-ip_global_traffic_manager","f5:big-ip_link_controller","f5:big-ip_local_traffic_manager","f5:big-ip_policy_enforcement_manager","f5:big-ip_protocol_security_module","f5:big-ip_wan_optimization_manager","f5:big-ip_webaccelerator","f5:big-iq_cloud","f5:big-iq_device","f5:big-iq_security","f5:enterprise_manager","f5:traffix_signaling_delivery_controller","gnu:bash","ibm:flex_system_v7000_firmware","ibm:infosphere_guardium_database_activity_monitoring","ibm:pureapplication_system","ibm:qradar_risk_manager","ibm:qradar_security_information_and_event_manager","ibm:qradar_vulnerability_manager","ibm:san_volume_controller_firmware","ibm:security_access_manager_for_mobile_8.0_firmware","ibm:security_access_manager_for_web_7.0_firmware","ibm:security_access_manager_for_web_8.0_firmware","ibm:smartcloud_entry_appliance","ibm:smartcloud_provisioning","ibm:software_defined_network_for_virtual_environments","ibm:starter_kit_for_cloud","ibm:stn6500_firmware","ibm:stn6800_firmware","ibm:stn7800_firmware","ibm:storwize_v3500_firmware","ibm:storwize_v3700_firmware","ibm:storwize_v5000_firmware","ibm:storwize_v7000_firmware","ibm:workload_deployer","mageia:mageia","novell:open_enterprise_server"],"source":"nvd","synced_at":"2026-10-19T20:34:04.196504363+00:00"},"epss":{"cve":"CVE-2014-7169","score":0.9994,"percentile":0.99972,"date":"2026-10-31"},"kev":{"cve":"CVE-2014-7169","date_added":"2022-01-28","due_date":"2022-07-28","vendor":"GNU","product":"Bourne-Again Shell (Bash)","known_ransomware":false},"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}