Skip to content
Fencer Intel
critical 9.8

CVE-2014-7169 kev in the critical feed json

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variab…

published 2014-09-25 12 y ago modified 2026-06-17 4 mo ago also EUVD-2014-7046

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2022-01-28
epss
99.9%
EPSS 99.9% chance of exploitation in 30 days, percentile 99.9%
public exploits
15
Exploit-DB

Summary

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • ibm software_defined_network_for_virtual_environments 1.2.1
  • checkpoint security_gateway r77.30
  • arista eos 4.9.12, 4.10.9, 4.11.11, 4.12.9, 4.13.9, 4.14.4f
  • qnap qts 4.1.1
  • ibm storwize_v7000_firmware 1.4.3.5, 1.5.0.4, 7.2.0.9, 7.3.0.7
  • ibm storwize_v5000_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm storwize_v3700_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm storwize_v3500_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm flex_system_v7000_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm san_volume_controller_firmware 7.1.0.11, 7.2.0.9, 7.3.0.7
  • ibm stn6500_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • ibm stn6800_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • ibm stn7800_firmware 3.8.0.07, 3.9.1.08, 4.1.2.06
  • citrix netscaler_sdx_firmware 9.3.67.5r1, 10.1.129.11r1, 10.5.52.11r1
  • apple mac_os_x 10.10.0
  • bash Debian 14, Debian 13, Debian 12 4.3-9.2

debian advisories DEBIAN-CVE-2014-7169

  • bash Ubuntu 14.04 LTS 4.3-7ubuntu1.3

ubuntu advisories UBUNTU-CVE-2014-7169

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • bash RHEL 5 SJIS 3.2-32.el5_9.3.sjis.1
  • rhev-hypervisor6 rhev manager 3 6.5-20140930.1.el6ev
  • bash RHEL 5 SJIS 3.2-33.el5_11.1.sjis.2
  • bash RHEL 6 SJIS 4.1.2-15.el6_5.1.sjis.2
  • bash RHEL 5 3.2-33.el5_11.4
  • bash RHEL 6 4.1.2-15.el6_5.2
  • bash RHEL 7 4.2.45-5.el7_0.4
  • bash RHEL 4 ELS 3.0-27.el4.4

red hat advisories RHSA-2014:1865RHSA-2014:1354RHSA-2014:1312RHSA-2014:1311RHSA-2014:1306

  • bash openSUSE Tumbleweed 7.0-92.1

opensuse advisories openSUSE-SU-2024:10106-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2014-7169 updated cvss 5.1

bash: code execution via specially-crafted environment (Incomplete fix for CVE-2014-6271)

  • Red Hat Enterprise Linux (v. 5 server) bash 3.2-33.el5_11.4
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux AS (v. 4 ELS) bash 3.0-27.el4.4
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux Client (v. 7) bash 4.2.45-5.el7_0.4 Red Hat Enterprise Linux Client Optional (v. 7) bash-doc 4.2.45-5.el7_0.4, bash-debuginfo 4.2.45-5.el7_0.4
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.4) bash 4.1.2-15.el6_4.2
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux ComputeNode (v. 7) bash 4.2.45-5.el7_0.4 Red Hat Enterprise Linux ComputeNode Optional (v. 7) bash-doc 4.2.45-5.el7_0.4, bash-debuginfo 4.2.45-5.el7_0.4 Red Hat Enterprise Linux Desktop (v. 5 client) bash 3.2-33.el5_11.4 Red Hat Enterprise Linux Desktop (v. 6) bash 4.1.2-15.el6_5.2 Red Hat Enterprise Linux Desktop Optional (v. 6) bash 4.1.2-15.el6_5.2
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux ES (v. 4 ELS) bash 3.0-27.el4.4 Red Hat Enterprise Linux EUS (v. 5.9 server) bash 3.2-32.el5_9.3
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux HPC Node (v. 6) bash 4.1.2-15.el6_5.2
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.4) bash 4.1.2-15.el6_4.2
    fixed: vendor fix RHSA-2014:1311
show 10 more
  • Red Hat Enterprise Linux HPC Node Optional (v. 6) bash 4.1.2-15.el6_5.2
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux Long Life (v. 5.6 server) bash 3.2-24.el5_6.2
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux Server (v. 6) bash 4.1.2-15.el6_5.2 Red Hat Enterprise Linux Server (v. 7) bash 4.2.45-5.el7_0.4
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux Server AUS (v. 6.2) bash 4.1.2-9.el6_2.2 Red Hat Enterprise Linux Server EUS (v. 6.4) bash 4.1.2-15.el6_4.2
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux Server Optional (v. 6) bash 4.1.2-15.el6_5.2 Red Hat Enterprise Linux Server Optional (v. 7) bash-doc 4.2.45-5.el7_0.4, bash-debuginfo 4.2.45-5.el7_0.4
    fixed: vendor fix RHSA-2014:1306
  • Red Hat Enterprise Linux Server Optional AUS (v. 6.2) bash 4.1.2-9.el6_2.2 Red Hat Enterprise Linux Server Optional EUS (v. 6.4) bash 4.1.2-15.el6_4.2
    fixed: vendor fix RHSA-2014:1311
  • Red Hat Enterprise Linux Workstation (v. 6) bash 4.1.2-15.el6_5.2 Red Hat Enterprise Linux Workstation (v. 7) bash 4.2.45-5.el7_0.4 Red Hat Enterprise Linux Workstation Optional (v. 6) bash 4.1.2-15.el6_5.2 Red Hat Enterprise Linux Workstation Optional (v. 7) bash-doc 4.2.45-5.el7_0.4, bash-debuginfo 4.2.45-5.el7_0.4
    fixed: vendor fix RHSA-2014:1306
  • Red Hat RHEV-M 3.4 rhev-hypervisor6 6.5-20140930.1.el6ev
    fixed: vendor fix RHSA-2014:1354
  • Red Hat S-JIS for Red Hat Enteprise Linux 5 Server bash 3.2-33.el5_11.1.sjis.2 Red Hat S-JIS for Red Hat Enteprise Linux 6 Server bash 4.1.2-15.el6_5.1.sjis.2
    fixed: vendor fix RHSA-2014:1312
  • Red Hat SJIS (v. 5.9.z Server) bash 3.2-32.el5_9.3.sjis.1
    fixed: vendor fix RHSA-2014:1865

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (EDB-34777)
  2. Published
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-07-28 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
GNU, Bourne-Again Shell (Bash)
CISA name
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

  • T1133 External Remote Services exploitation
  • T1190 Exploit Public-Facing Application exploitation
  • T1059.004 Unix Shell primary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
20 mo ago

Exploit prediction

99.94% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • EDB-36933 dhclient 4.1 - Bash Environment Variable Command Injection (Shellshock) remote, 2014-09-29
  • EDB-36609 Kemp Load Master 7.1.16 - Multiple Vulnerabilities webapps, 2015-04-02
  • EDB-36504 QNAP - Web Server Remote Code Execution via Bash Environment Variable Code Injection (Metasploit) remote, 2015-03-26
  • EDB-36503 QNAP - Admin Shell via Bash Environment Variable Code Injection (Metasploit) remote, 2015-03-26
  • EDB-35146 PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection webapps, 2014-11-03
  • EDB-35115 CUPS Filter - Bash Environment Variable Code Injection (Metasploit) remote, 2014-10-29
  • EDB-34896 Postfix SMTP 4.2.x < 4.2.48 - 'Shellshock' Remote Command Injection remote, 2014-10-06
  • EDB-34895 Bash CGI - 'Shellshock' Remote Command Injection (Metasploit) webapps, 2014-10-06
  • EDB-34879 OpenVPN 2.2.29 - 'Shellshock' Remote Command Injection remote, 2014-10-04
  • EDB-34862 Pure-FTPd - External Authentication Bash Environment Variable Code Injection (Metasploit) remote, 2014-10-02
  • EDB-34860 GNU bash 4.3.11 - Environment Variable dhclient remote, 2014-10-02
  • EDB-34839 IPFire - CGI Web Interface (Authenticated) Bash Environment Variable Code Injection webapps, 2014-10-01
  • EDB-34777 GNU Bash - Environment Variable Command Injection (Metasploit) remote, 2014-09-25
  • EDB-34766 Bash - 'Shellshock' Environment Variables Command Injection remote, 2014-09-25
  • EDB-34765 GNU Bash - 'Shellshock' Environment Variable Command Injection remote, 2014-09-25
  • packetstormsecurity.com http://packetstormsecurity.com/files/128517/VMware-Security-Advisory-2014-0010.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/128567/CA-Technologies-GNU-Bash-Shellshock.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.