10

CVE-2014-6278

Warning

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.

Data is provided by the National Vulnerability Database (NVD)
Gnu ≫ Bash Version1.14.0
Gnu ≫ Bash Version1.14.1
Gnu ≫ Bash Version1.14.2
Gnu ≫ Bash Version1.14.3
Gnu ≫ Bash Version1.14.4
Gnu ≫ Bash Version1.14.5
Gnu ≫ Bash Version1.14.6
Gnu ≫ Bash Version1.14.7
Gnu ≫ Bash Version2.0
Gnu ≫ Bash Version2.01
Gnu ≫ Bash Version2.01.1
Gnu ≫ Bash Version2.02
Gnu ≫ Bash Version2.02.1
Gnu ≫ Bash Version2.03
Gnu ≫ Bash Version2.04
Gnu ≫ Bash Version2.05
Gnu ≫ Bash Version2.05 Updatea
Gnu ≫ Bash Version2.05 Updateb
Gnu ≫ Bash Version3.0
Gnu ≫ Bash Version3.0.16
Gnu ≫ Bash Version3.1
Gnu ≫ Bash Version3.2
Gnu ≫ Bash Version3.2.48
Gnu ≫ Bash Version4.0
Gnu ≫ Bash Version4.0 Updaterc1
Gnu ≫ Bash Version4.1
Gnu ≫ Bash Version4.2
Gnu ≫ Bash Version4.3

02.10.2025: CISA Known Exploited Vulnerabilities (KEV) Catalog

GNU Bash OS Command Injection Vulnerability

Vulnerability

GNU Bash contains an OS command injection vulnerability which allows remote attackers to execute arbitrary commands via a crafted environment.

Description

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 91.61% 0.997
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
134c704f-9b21-4f2e-91b3-4a467353bcc0 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.