CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2014-7169
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
Severity
- EPSS
- 100% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
- CISA KEV
- listed 2022-01-28, due 2022-07-28
- CWE
- CWE-78
- Published
- Modified
- Record from
- the NVD, synced
Affected
- apple:mac_os_x
- arista:eos
- canonical:ubuntu_linux
- checkpoint:security_gateway
- citrix:netscaler_sdx_firmware
- debian:debian_linux
- f5:arx_firmware
- f5:big-ip_access_policy_manager
- f5:big-ip_advanced_firewall_manager
- f5:big-ip_analytics
- f5:big-ip_application_acceleration_manager
- f5:big-ip_application_security_manager
- f5:big-ip_edge_gateway
- f5:big-ip_global_traffic_manager
- f5:big-ip_link_controller
- f5:big-ip_local_traffic_manager
- f5:big-ip_policy_enforcement_manager
- f5:big-ip_protocol_security_module
- f5:big-ip_wan_optimization_manager
- f5:big-ip_webaccelerator
- f5:big-iq_cloud
- f5:big-iq_device
- f5:big-iq_security
- f5:enterprise_manager
- f5:traffix_signaling_delivery_controller
- gnu:bash
- ibm:flex_system_v7000_firmware
- ibm:infosphere_guardium_database_activity_monitoring
- ibm:pureapplication_system
- ibm:qradar_risk_manager
- ibm:qradar_security_information_and_event_manager
- ibm:qradar_vulnerability_manager
- ibm:san_volume_controller_firmware
- ibm:security_access_manager_for_mobile_8.0_firmware
- ibm:security_access_manager_for_web_7.0_firmware
- ibm:security_access_manager_for_web_8.0_firmware
- ibm:smartcloud_entry_appliance
- ibm:smartcloud_provisioning
- ibm:software_defined_network_for_virtual_environments
- ibm:starter_kit_for_cloud
- ibm:stn6500_firmware
- ibm:stn6800_firmware
- ibm:stn7800_firmware
- ibm:storwize_v3500_firmware
- ibm:storwize_v3700_firmware
- ibm:storwize_v5000_firmware
- ibm:storwize_v7000_firmware
- ibm:workload_deployer
- mageia:mageia
- novell:open_enterprise_server