Evil-DB LogoEvil-DB
← All CVEs

CVE-2014-7169

critical · 9.8Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply updates per vendor instructions.

Added 2022-01-28Remediation due 2022-07-28

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

9.8
CVSS
99.9%
EPSS (exploit prob.)
100th
EPSS percentile
2014-09-25
Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-78

Affected products

VendorProductAffected versions
gnubash<= 4.3
aristaeos>= 4.9.0, < 4.9.12
aristaeos>= 4.10.0, < 4.10.9
aristaeos>= 4.11.0, < 4.11.11
aristaeos>= 4.12.0, < 4.12.9
aristaeos>= 4.13.0, < 4.13.9
aristaeos>= 4.14.0, < 4.14.4f
oraclelinux4
oraclelinux5
oraclelinux6
qnapqts< 4.1.1
qnapqts4.1.1
qnapqts4.1.1
mageiamageia3.0
mageiamageia4.0
redhatgluster_storage_server_for_on-premise2.1
redhatvirtualization3.4
redhatenterprise_linux4.0
redhatenterprise_linux5.0
redhatenterprise_linux6.0
redhatenterprise_linux7.0
redhatenterprise_linux_desktop5.0
redhatenterprise_linux_desktop6.0
redhatenterprise_linux_desktop7.0
redhatenterprise_linux_eus5.9
redhatenterprise_linux_eus6.4
redhatenterprise_linux_eus6.5
redhatenterprise_linux_eus7.3
redhatenterprise_linux_eus7.4
redhatenterprise_linux_eus7.5
redhatenterprise_linux_eus7.6
redhatenterprise_linux_eus7.7
redhatenterprise_linux_for_ibm_z_systems5.9_s390x
redhatenterprise_linux_for_ibm_z_systems6.4_s390x
redhatenterprise_linux_for_ibm_z_systems6.5_s390x
redhatenterprise_linux_for_ibm_z_systems7.3_s390x
redhatenterprise_linux_for_ibm_z_systems7.4_s390x
redhatenterprise_linux_for_ibm_z_systems7.5_s390x
redhatenterprise_linux_for_ibm_z_systems7.6_s390x
redhatenterprise_linux_for_ibm_z_systems7.7_s390x

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2014-7169