GNU Bash OS Command Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 02/10/2025. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| bash | = 1.14.0= 1.14.1= 1.14.2= 1.14.3= 1.14.4= 1.14.5= 1.14.6= 1.14.7= 2.0= 2.01= 2.01.1= 2.02= 2.02.1= 2.03= 2.04= 2.05= 3.0= 3.0.16= 3.1= 3.2= 3.2.48= 4.0= 4.1= 4.2= 4.3 |
GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free