GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

cat cve-2014-6271.json

Vendor: GNU
Product: Bourne-Again Shell (Bash)
CVSS: 9.8
EPSS (exploit probability): 100.0%
Status: kev
CISA patch-by (BOD 22-01): July 28, 2022
Published: January 28, 2022
Source: https://nvd.nist.gov/vuln/detail/CVE-2014-6271

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

Added to CISA’s Known Exploited Vulnerabilities catalog on 2022-01-28. Required action per CISA: Apply updates per vendor instructions. Due date: 2022-07-28.

This is an auto-synced KEV catalog record pending a full 0dayNews write-up — see CISA’s KEV catalog and the NVD record linked above for primary sources.