CVE-2014-7169

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2014-7169
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2014-09-25 01:55:00 UTC
Updated2021-11-17 22:15:00 UTC
DescriptionGNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Risk And Classification

EPSS: 0.901080000 probability, percentile 0.995830000 (date 2026-04-01)

CISA KEV: Listed on 2022-01-28; due 2022-07-28; ransomware use Unknown

Problem Types: CWE-78

CISA Known Exploited Vulnerability

VendorGNU
ProductBourne-Again Shell (Bash)
NameGNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
Required ActionApply updates per vendor instructions.
Noteshttps://nvd.nist.gov/vuln/detail/CVE-2014-7169

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Gnu Bash 1.14.0 All All All
Application Gnu Bash 1.14.1 All All All
Application Gnu Bash 1.14.2 All All All
Application Gnu Bash 1.14.3 All All All
Application Gnu Bash 1.14.4 All All All
Application Gnu Bash 1.14.5 All All All
Application Gnu Bash 1.14.6 All All All
Application Gnu Bash 1.14.7 All All All
Application Gnu Bash 2.0 All All All
Application Gnu Bash 2.01 All All All
Application Gnu Bash 2.01.1 All All All
Application Gnu Bash 2.02 All All All
Application Gnu Bash 2.02.1 All All All
Application Gnu Bash 2.03 All All All
Application Gnu Bash 2.04 All All All
Application Gnu Bash 2.05 All All All
Application Gnu Bash 2.05 a All All
Application Gnu Bash 2.05 b All All
Application Gnu Bash 3.0 All All All
Application Gnu Bash 3.0.16 All All All
Application Gnu Bash 3.1 All All All
Application Gnu Bash 3.2 All All All
Application Gnu Bash 3.2.48 All All All
Application Gnu Bash 4.0 All All All
Application Gnu Bash 4.0 rc1 All All
Application Gnu Bash 4.1 All All All
Application Gnu Bash 4.2 All All All
Application Gnu Bash 4.3 All All All
Application Gnu Bash 1.14.0 All All All
Application Gnu Bash 1.14.1 All All All
Application Gnu Bash 1.14.2 All All All
Application Gnu Bash 1.14.3 All All All
Application Gnu Bash 1.14.4 All All All
Application Gnu Bash 1.14.5 All All All
Application Gnu Bash 1.14.6 All All All
Application Gnu Bash 1.14.7 All All All
Application Gnu Bash 2.0 All All All
Application Gnu Bash 2.01 All All All
Application Gnu Bash 2.01.1 All All All
Application Gnu Bash 2.02 All All All
Application Gnu Bash 2.02.1 All All All
Application Gnu Bash 2.03 All All All
Application Gnu Bash 2.04 All All All
Application Gnu Bash 2.05 All All All
Application Gnu Bash 2.05 a All All
Application Gnu Bash 2.05 b All All
Application Gnu Bash 3.0 All All All
Application Gnu Bash 3.0.16 All All All
Application Gnu Bash 3.1 All All All
Application Gnu Bash 3.2 All All All
Application Gnu Bash 3.2.48 All All All
Application Gnu Bash 4.0 All All All
Application Gnu Bash 4.0 rc1 All All
Application Gnu Bash 4.1 All All All
Application Gnu Bash 4.2 All All All
Application Gnu Bash 4.3 All All All

References

ReferenceSourceLinkTags
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect SmartCloud Provisioning for IBM Provided Software Virtual Appliance - United States CONFIRM www-01.ibm.com
HPE Support document - HPE Support Center CONFIRM support.hpe.com
Oracle Security Alert CVE-2014-7169 CONFIRM www.oracle.com
'[security bulletin] HPSBMU03133 rev.1 - HP Enterprise Maps Virtual Appliance running Bash Shell, Rem' - MARC HP marc.info
IBM notice: The page you requested cannot be displayed CONFIRM www-01.ibm.com
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect Virtual Server Protection for VMware (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
About Secunia Research | Flexera SECUNIA secunia.com
Citrix XenServer Shellshock Security Update CONFIRM support.citrix.com
HPE Support document - HPE Support Center CONFIRM support.hpe.com
'[security bulletin] HPSBST03157 rev.1 - HP StoreEver ESL E-series Tape Library and HP Virtual Librar' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
SecurityFocus BUGTRAQ www.securityfocus.com
Security Advisory SA61618 - Red Hat update for bash - Secunia SECUNIA secunia.com
'[security bulletin] HPSBMU03246 rev.1 - HP Insight Control for Linux Central Management Server Pre-b' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBOV03228 rev.1 - HP OpenVMS running Bash Shell, Remote Code Execution' - MARC HP marc.info
Citrix Security Advisory for GNU Bash Shellshock Vulnerabilities CONFIRM support.citrix.com
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBST03195 rev.1 - HP 3PAR Service Processor (SP) running OpenSSL and Bash, Rem' - MARC HP marc.info
Arista - Security Advisory 0006 MISC www.arista.com
linux.oracle.com | ELSA-2014-1306 CONFIRM linux.oracle.com
About Secunia Research | Flexera SECUNIA secunia.com
[security-announce] SUSE-SU-2014:1259-1: important: bash SUSE lists.opensuse.org
About Secunia Research | Flexera SECUNIA secunia.com
openSUSE-SU-2014:1308-1: moderate: update for bash SUSE lists.opensuse.org
About the security content of OS X Yosemite v10.10 - Apple Support CONFIRM support.apple.com
IBM Security Bulletin: UPDATE: Vulnerabilities in Bash affect AIX Toolbox for Linux Applications (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-7186, and CVE-2014-7187) - United States CONFIRM www-01.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect QRadar SIEM, QRadar Vulnerability Manager, QRadar Risk Manager, and QRadar Incident Forensics (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBMU03165 rev.1 - HP Propel running Bash Shell, Remote Code Execution' - MARC HP marc.info
'[security bulletin] HPSBGN03138 rev.1 - HP Operations Analytics running Bash Shell, Remote Code Exec' - MARC HP marc.info
'[security bulletin] HPSBST03131 rev.1 - HP StoreOnce Backup Systems running Bash Shell, Remote Code ' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBHF03146 rev.1 - HP Integrity SD2 CB900s i4 & i2 Server running Bash Shell, R' - MARC HP marc.info
ShellShock 101 - What you need to know and do, to ensure your systems are secure CONFIRM www.suse.com
About Secunia Research | Flexera SECUNIA secunia.com
linux.oracle.com | ELSA-2014-3075 - bash security update CONFIRM linux.oracle.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Workload Deployer (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
USN-2363-1: Bash vulnerability | Ubuntu UBUNTU www.ubuntu.com
About Secunia Research | Flexera SECUNIA secunia.com
JVNDB-2014-000126 JVNDB jvndb.jvn.jp
Support | ZENworks Configuration Management vulnerability with GNU Bash Remote Code Execution (aka ShellShock) CONFIRM www.novell.com
'[security bulletin] HPSBGN03233 rev.1 - HP OneView running OpenSSL, Remote Denial of Service (DoS), ' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169) - Red Hat Customer Portal CONFIRM access.redhat.com
'[security bulletin] HPSBMU03143 rev.1 - HP Virtualization Performance Viewer, Bash Shell, Remote Cod' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBHF03119 rev.1 - HP DreamColor Display running Bash Shell, Remote Code Execut' - MARC HP marc.info
[security-announce] openSUSE-SU-2014:1229-1: important: bash SUSE lists.opensuse.org
Tavis Ormandy na Twitterze: "The bash patch seems incomplete to me, function parsing is still brittle. e.g. $ env X='() { (a)=>\' sh -c "echo date"; cat echo" MISC twitter.com
QNAP Systems, Inc. - Network Attached Storage (NAS) CONFIRM www.qnap.com
Red Hat Customer Portal REDHAT rhn.redhat.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
Juniper Networks - 2014-09 Out of Cycle Security Bulletin: Multiple Products: Shell Command Injection Vulnerability in Bash - Knowledge Base CONFIRM kb.juniper.net
Security Advisory SA59272 - Red Hat update for bash - Secunia SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
McAfee KnowledgeBase - McAfee Security Bulletin - Bash Shellshock Code Injection Exploit Updates for CVE-2014-6271 and CVE-2014-7169 CONFIRM kc.mcafee.com
Security Advisory SA61619 - Ubuntu update for bash - Secunia SECUNIA secunia.com
'[security bulletin] HPSBGN03141 rev.1 - HP Automation Insight running Bash Shell, Remote Code Execut' - MARC HP marc.info
'[security bulletin] HPSBST03155 rev.1 - HP StoreFabric H-series switches running Bash Shell, Remote ' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect SAN Volume Controller and Storwize Family (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
Mageia Advisory: MGASA-2014-0393 - Updated bash packages fix CVE-2014-7169 CONFIRM advisories.mageia.org
'[security bulletin] HPSBST03129 rev.1 - HP StoreFabric B-series switches running Bash Shell, Remote ' - MARC HP marc.info
IBM Security Bulletin: Vulnerabilities in Bash affect IBM PureData System for Operational Analytics (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
Bash Code Injection Vulnerability via Specially Crafted Environment Variables (CVE-2014-6271, CVE-2014-7169) - Red Hat Customer Portal CONFIRM access.redhat.com
Red Hat Customer Portal REDHAT rhn.redhat.com
'[security bulletin] HPSBST03154 rev.1 - HP StoreFabric C-series MDS switches and HP C-series Nexus 5' - MARC HP marc.info
SOL15629 - Multiple GNU Bash vulnerabilities CONFIRM support.f5.com
About Secunia Research | Flexera SECUNIA secunia.com
OpenVPN 2.2.29 - ShellShock Exploit EXPLOIT-DB www.exploit-db.com
NEOHAPSIS - Peace of Mind Through Integrity and Insight APPLE archives.neohapsis.com
Red Hat Customer Portal REDHAT rhn.redhat.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
[security-announce] SUSE-SU-2014:1247-1: important: Security update for SUSE lists.opensuse.org
[security-announce] openSUSE-SU-2014:1254-1: critical: bash SUSE lists.opensuse.org
linux.oracle.com | ELSA-2014-3078 - bash security update CONFIRM linux.oracle.com
Security Advisory SA62228 - HP OpenVMS update for Bash - Secunia SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash and GNU C Library affect WebSphere Transformation Extender (WTX) with Launcher Hypervisor Edition (CVE-2014-6271, CVE-2014-6277, CVE-2014-6278, CVE-2014-7169, CVE-2014-5119, CVE-2014-7186, CVE-2014-7187) - United States CONFIRM www-01.ibm.com
IBM Support CONFIRM www-947.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM SDN VE (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
StruxureWare Data Center Operation Software Vulnerability Fixes - User Assistance for StruxureWare Data Center Operation 8 - Help Center: Support for EcoStruxure IT, StruxureWare for Data Centers, and NetBotz CONFIRM help.ecostruxureit.com
linux.oracle.com | ELSA-2014-3077 - bash security update CONFIRM linux.oracle.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBHF03125 rev.1 - HP Next Generation Firewall (NGFW) running Bash Shell, Remot' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBHF03145 rev.1 - HP Integrity Superdome X and HP Converged System 900 for SAP' - MARC HP marc.info
'[security bulletin] HPSBGN03117 rev.1 - HP Remote Device Access: Virtual Customer Access System (vCA' - MARC HP marc.info
'[security bulletin] HPSBST03122 rev.1 - HP StoreAll Operating System Software running Bash Shell, Re' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
oss-security - Re: CVE-2014-6271: remote code execution through bash MLIST www.openwall.com
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: IBM Real-time Compression Appliance is exposed to the following Bash vulnerabilities: CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278 - United States CONFIRM www-01.ibm.com
'[security bulletin] HPSBHF03124 rev.1 - HP Thin Clients running Bash, Remote Execution of Code' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
Security Advisory SA61626 - Oracle Linux update for bash - Secunia SECUNIA secunia.com
USN-2363-2: Bash vulnerability | Ubuntu UBUNTU www.ubuntu.com
About Secunia Research | Flexera SECUNIA secunia.com
openSUSE-SU-2014:1310-1: moderate: update for bash SUSE lists.opensuse.org
Debian -- Security Information -- DSA-3035-1 bash DEBIAN www.debian.org
'[security bulletin] HPSBST03148 rev.1 - HP StoreOnce Gen 2 Backup Systems running Bash Shell, Remote' - MARC HP marc.info
'[security bulletin] HPSBMU03245 rev.1 - HP Insight Control server deployment Linux Preboot Execution' - MARC HP marc.info
GNU Bash Environment Variable Command Injection Vulnerability CISCO tools.cisco.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM System Storage Storwize V7000 Unified (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
'[security bulletin] HPSBMU03220 rev.1 - HP Shunra Network Appliance / HP Shunra Wildcat Appliance, R' - MARC HP marc.info
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Security Access Manager for Mobile and IBM Security Access Manager for Web (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
[security-announce] SUSE-SU-2014:1287-1: important: Security update for SUSE lists.opensuse.org
IBM Security Bulletin: Vulnerabilities in Bash affect IBM SmartCloud Entry Appliance (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
CA Technologies GNU Bash Shellshock ≈ Packet Storm MISC packetstormsecurity.com
JVN#55667175: QNAP QTS vulnerable to OS command injection JVN jvn.jp
About OS X bash Update 1.0 - Apple Support CONFIRM support.apple.com
Vulnerability Note VU#252743 - GNU Bash shell executes commands in exported functions in environment variables CERT-VN www.kb.cert.org US Government Resource
Support | OES11 SP2, OES11SP1, OES2 SP3 vulnerability with GNU Bash Remote Code Execution (aka ShellShock) and Mozilla NSS vulnerabilities CONFIRM www.novell.com
'[security bulletin] HPSBMU03182 rev.1 - HP Server Automation running Bash Shell, Remote Code Executi' - MARC HP marc.info
Full Disclosure: FW: NEW VMSA-2014-0010 - VMware product updates address critical Bash security vulnerabilities FULLDISC seclists.org
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Smart Analytics System 7600, 7700 and 7710 (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
lcamtuf's blog: Quick notes about the bash bug, its impact, and the fixes so far MISC lcamtuf.blogspot.com
Security Advisory SA61622 - Debian update for bash - Secunia SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM Smart Analytics System 5600 (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM PureApplication System (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
Red Hat Customer Portal REDHAT rhn.redhat.com
IBM Security Bulletin: Vulnerabilities in Bash affect IBM InfoSphere Guardium Database Activity Monitoring (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
GNU Bourne-Again Shell (Bash) ‘Shellshock’ Vulnerability (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277 and CVE 2014-6278) | US-CERT CERT www.us-cert.gov US Government Resource
'[security bulletin] HPSBMU03217 rev.1 - HP Vertica Analytics Platform running Bash Shell, Remote Cod' - MARC HP marc.info
About Secunia Research | Flexera SECUNIA secunia.com
'[security bulletin] HPSBGN03142 rev.1 - HP Business Service Automation Essentials running Bash Shell' - MARC HP marc.info
'[security bulletin] HPSBMU03144 rev.1 - HP Operation Agent Virtual Appliance, Bash Shell, Remote Cod' - MARC HP marc.info
Security Advisory SA61479 - SUSE update for bash - Secunia SECUNIA secunia.com
[security-announce] openSUSE-SU-2014:1242-1: important: bash SUSE lists.opensuse.org
About Secunia Research | Flexera SECUNIA secunia.com
VMSA-2014-0010.13 | United States CONFIRM www.vmware.com
IBM Security Bulletin: Vulnerabilities in Bash affect Proventia Network Enterprise Scanner (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
About Secunia Research | Flexera SECUNIA secunia.com
About Secunia Research | Flexera SECUNIA secunia.com
Support / Security / Advisories / / MDVSA-2015:164 | Mandriva MANDRIVA www.mandriva.com
VMware Security Advisory 2014-0010 ≈ Packet Storm MISC packetstormsecurity.com
Check Point Response to CVE-2014-6271 and CVE-2014-7169 Bash Code Injection vulnerability CONFIRM supportcenter.checkpoint.com
CVE-2014-7169 CONFIRM support.novell.com
GNU Bash Shellshock command injection vulnerabilities | Blue Coat Systems, Inc. CONFIRM kb.bluecoat.com
IBM Security Bulletin: Vulnerabilities in Bash affect DS8000 HMC (CVE-2014-6271, CVE-2014-7169, CVE-2014-7186, CVE-2014-7187, CVE-2014-6277, CVE-2014-6278) - United States CONFIRM www-01.ibm.com
'[security bulletin] HPSBST03181 rev.1 - HP StoreEver ESL G3 Tape Library running Bash Shell, Remote ' - MARC HP marc.info
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
CISA Known Exploited Vulnerabilities catalog CISA www.cisa.gov kev
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report