{"cve_id":"CVE-2014-7169","published":"2014-09-25T01:55:04.367000+00:00","last_modified":"2026-06-17T00:14:28.143000+00:00","vuln_status":"Analyzed","description":"GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.","cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","base_score":9.8,"base_severity":"CRITICAL","attack_vector":"NETWORK","privileges_req":"NONE","user_interaction":"NONE","scope":"UNCHANGED","impact_c":"HIGH","impact_i":"HIGH","impact_a":"HIGH","cwe_ids":["CWE-78"],"in_kev":true,"kev_date_added":"2022-01-28","kev_ransomware":false,"epss_score":0.9994,"epss_percentile":0.99972,"cap_rule_version":"0.1.1","stage":"INITIAL_ACCESS","req_access":"NONE","req_vector":"NETWORK","req_user_interaction":false,"grant_access":"USER","caps":["CODE_EXEC"],"terminal":false,"cap_confidence":"high","ingested_at":"2026-09-18T08:19:04.748137+00:00","first_seen":"2014-09-25T01:55:04.367000+00:00","kev_first_seen":"2022-01-28T00:00:00+00:00","novelty_score":0.0,"novelty_reasons":[],"novelty_at":null,"vendors":["apple","arista","canonical","checkpoint","citrix","debian","f5","gnu","ibm","mageia","novell","opensuse","oracle","qnap","redhat","suse","vmware"],"products":["arx","arx_firmware","bash","big-ip_access_policy_manager","big-ip_advanced_firewall_manager","big-ip_analytics","big-ip_application_acceleration_manager","big-ip_application_security_manager","big-ip_edge_gateway","big-ip_global_traffic_manager","big-ip_link_controller","big-ip_local_traffic_manager","big-ip_policy_enforcement_manager","big-ip_protocol_security_module","big-ip_wan_optimization_manager","big-ip_webaccelerator","big-iq_cloud","big-iq_device","big-iq_security","debian_linux","enterprise_linux","enterprise_linux_desktop","enterprise_linux_eus","enterprise_linux_for_ibm_z_systems","enterprise_linux_for_power_big_endian","enterprise_linux_for_power_big_endian_eus","enterprise_linux_for_scientific_computing","enterprise_linux_server","enterprise_linux_server_aus","enterprise_linux_server_from_rhui","enterprise_linux_server_tus","enterprise_linux_workstation","enterprise_manager","eos","esx","flex_system_v7000","flex_system_v7000_firmware","gluster_storage_server_for_on-premise","infosphere_guardium_database_activity_monitoring","linux","linux_enterprise_desktop","linux_enterprise_server","linux_enterprise_software_development_kit","mac_os_x","mageia","netscaler_sdx","netscaler_sdx_firmware","open_enterprise_server","opensuse","pureapplication_system","qradar_risk_manager","qradar_security_information_and_event_manager","qradar_vulnerability_manager","qts","san_volume_controller","san_volume_controller_firmware","security_access_manager_for_mobile_8.0_firmware","security_access_manager_for_web_7.0_firmware","security_access_manager_for_web_8.0_firmware","security_gateway","smartcloud_entry_appliance","smartcloud_provisioning","software_defined_network_for_virtual_environments","starter_kit_for_cloud","stn6500","stn6500_firmware","stn6800","stn6800_firmware","stn7800","stn7800_firmware","storwize_v3500","storwize_v3500_firmware","storwize_v3700","storwize_v3700_firmware","storwize_v5000","storwize_v5000_firmware","storwize_v7000","storwize_v7000_firmware","studio_onsite","traffix_signaling_delivery_controller","ubuntu_linux","vcenter_server_appliance","virtualization","workload_deployer","zenworks_configuration_management"],"affected":[{"vendor":"apple","product":"mac_os_x","ranges":["≥ 10.0.0 and < 10.10.0"]},{"vendor":"arista","product":"eos","ranges":["≥ 4.14.0 and < 4.14.4f","≥ 4.13.0 and < 4.13.9","≥ 4.10.0 and < 4.10.9","≥ 4.11.0 and < 4.11.11","≥ 4.12.0 and < 4.12.9","≥ 4.9.0 and < 4.9.12"]},{"vendor":"canonical","product":"ubuntu_linux","ranges":["12.04","14.04","10.04"]},{"vendor":"checkpoint","product":"security_gateway","ranges":["< r77.30"]},{"vendor":"citrix","product":"netscaler_sdx_firmware","ranges":["< 9.3.67.5r1","≥ 10 and < 10.1.129.11r1","≥ 10.5 and < 10.5.52.11r1"]},{"vendor":"debian","product":"debian_linux","ranges":["7.0"]},{"vendor":"f5","product":"arx_firmware","ranges":["≥ 6.0.0 and ≤ 6.4.0"]},{"vendor":"f5","product":"big-ip_access_policy_manager","ranges":["≥ 11.0.0 and ≤ 11.5.1","≥ 10.1.0 and ≤ 10.2.4","11.6.0"]},{"vendor":"f5","product":"big-ip_advanced_firewall_manager","ranges":["≥ 11.3.0 and ≤ 11.5.1","11.6.0"]},{"vendor":"f5","product":"big-ip_analytics","ranges":["11.6.0","≥ 11.0.0 and ≤ 11.5.1"]},{"vendor":"f5","product":"big-ip_application_acceleration_manager","ranges":["≥ 11.4.0 and ≤ 11.5.1","11.6.0"]},{"vendor":"f5","product":"big-ip_application_security_manager","ranges":["≥ 11.0.0 and ≤ 11.5.1","≥ 10.0.0 and ≤ 10.2.4","11.6.0"]},{"vendor":"f5","product":"big-ip_edge_gateway","ranges":["≥ 10.1.0 and ≤ 10.2.4","≥ 11.0.0 and ≤ 11.3.0"]},{"vendor":"f5","product":"big-ip_global_traffic_manager","ranges":["≥ 10.0.0 and ≤ 10.2.4","11.6.0","≥ 11.0.0 and ≤ 11.5.1"]},{"vendor":"f5","product":"big-ip_link_controller","ranges":["11.6.0","≥ 11.0.0 and ≤ 11.5.1","≥ 10.0.0 and ≤ 10.2.4"]},{"vendor":"f5","product":"big-ip_local_traffic_manager","ranges":["11.6.0","≥ 11.0.0 and ≤ 11.5.1","≥ 10.0.0 and ≤ 10.2.4"]},{"vendor":"f5","product":"big-ip_policy_enforcement_manager","ranges":["11.6.0","≥ 11.3.0 and ≤ 11.5.1"]},{"vendor":"f5","product":"big-ip_protocol_security_module","ranges":["≥ 11.0.0 and ≤ 11.4.1","≥ 10.0.0 and ≤ 10.2.4"]},{"vendor":"f5","product":"big-ip_wan_optimization_manager","ranges":["≥ 11.0.0 and ≤ 11.3.0","≥ 10.0.0 and ≤ 10.2.4"]},{"vendor":"f5","product":"big-ip_webaccelerator","ranges":["≥ 10.0.0 and ≤ 10.2.4","≥ 11.0.0 and ≤ 11.3.0"]},{"vendor":"f5","product":"big-iq_cloud","ranges":["≥ 4.0.0 and ≤ 4.4.0"]},{"vendor":"f5","product":"big-iq_device","ranges":["≥ 4.2.0 and ≤ 4.4.0"]},{"vendor":"f5","product":"big-iq_security","ranges":["≥ 4.0.0 and ≤ 4.4.0"]},{"vendor":"f5","product":"enterprise_manager","ranges":["≥ 2.1.0 and ≤ 2.3.0","≥ 3.0.0 and ≤ 3.1.1"]},{"vendor":"f5","product":"traffix_signaling_delivery_controller","ranges":["3.4.1","≥ 4.0.0 and ≤ 4.0.5","3.3.2","4.1.0","3.5.1"]},{"vendor":"gnu","product":"bash","ranges":["≤ 4.3"]},{"vendor":"ibm","product":"flex_system_v7000_firmware","ranges":["≥ 7.3.0.0 and < 7.3.0.7","≥ 1.1.0.0 and < 7.1.0.11","≥ 7.2.0.0 and < 7.2.0.9"]},{"vendor":"ibm","product":"infosphere_guardium_database_activity_monitoring","ranges":["9.1","9.0","8.2"]},{"vendor":"ibm","product":"pureapplication_system","ranges":["≥ 1.0.0.0 and ≤ 1.0.0.4","≥ 1.1.0.0 and ≤ 1.1.0.4","2.0.0.0"]},{"vendor":"ibm","product":"qradar_risk_manager","ranges":["7.1.0"]},{"vendor":"ibm","product":"qradar_security_information_and_event_manager","ranges":["7.1.2","7.1.0","7.1.1","7.2","7.2.0","7.2.1","7.2.2","7.2.3","7.2.4","7.2.5","7.2.6","7.2.7","7.2.8","7.2.8.15","7.2.9"]},{"vendor":"ibm","product":"qradar_vulnerability_manager","ranges":["7.2.1","7.2.8","7.2.6","7.2.4","7.2.3","7.2.2","7.2.0"]},{"vendor":"ibm","product":"san_volume_controller_firmware","ranges":["≥ 7.3.0.0 and < 7.3.0.7","≥ 1.1.0.0 and < 7.1.0.11","≥ 7.2.0.0 and < 7.2.0.9"]},{"vendor":"ibm","product":"security_access_manager_for_mobile_8.0_firmware","ranges":["8.0.0.3","8.0.0.1","8.0.0.5","8.0.0.2"]},{"vendor":"ibm","product":"security_access_manager_for_web_7.0_firmware","ranges":["7.0.0.7","7.0.0.5","7.0.0.4","7.0.0.3","7.0.0.2","7.0.0.1","7.0.0.8","7.0.0.6"]},{"vendor":"ibm","product":"security_access_manager_for_web_8.0_firmware","ranges":["8.0.0.3","8.0.0.2","8.0.0.5"]},{"vendor":"ibm","product":"smartcloud_entry_appliance","ranges":["2.4.0","3.2.0","3.1.0","2.3.0"]},{"vendor":"ibm","product":"smartcloud_provisioning","ranges":["2.1.0"]},{"vendor":"ibm","product":"software_defined_network_for_virtual_environments","ranges":["< 1.2.1"]},{"vendor":"ibm","product":"starter_kit_for_cloud","ranges":["2.2.0"]},{"vendor":"ibm","product":"stn6500_firmware","ranges":["≥ 3.8.0.0 and < 3.8.0.07","≥ 3.9.1.0 and < 3.9.1.08","≥ 4.1.2.0 and < 4.1.2.06"]},{"vendor":"ibm","product":"stn6800_firmware","ranges":["≥ 4.1.2.0 and < 4.1.2.06","≥ 3.9.1.0 and < 3.9.1.08","≥ 3.8.0.0 and < 3.8.0.07"]},{"vendor":"ibm","product":"stn7800_firmware","ranges":["≥ 3.9.1.0 and < 3.9.1.08","≥ 4.1.2.0 and < 4.1.2.06","≥ 3.8.0.0 and < 3.8.0.07"]},{"vendor":"ibm","product":"storwize_v3500_firmware","ranges":["≥ 7.2.0.0 and < 7.2.0.9","≥ 1.1.0.0 and < 7.1.0.11","≥ 7.3.0.0 and < 7.3.0.7"]},{"vendor":"ibm","product":"storwize_v3700_firmware","ranges":["≥ 7.3.0.0 and < 7.3.0.7","≥ 1.1.0.0 and < 7.1.0.11","≥ 7.2.0.0 and < 7.2.0.9"]},{"vendor":"ibm","product":"storwize_v5000_firmware","ranges":["≥ 1.1.0.0 and < 7.1.0.11","≥ 7.2.0.0 and < 7.2.0.9","≥ 7.3.0.0 and < 7.3.0.7"]},{"vendor":"ibm","product":"storwize_v7000_firmware","ranges":["≥ 7.2.0.0 and < 7.2.0.9","≥ 7.3.0.0 and < 7.3.0.7","≥ 1.5.0.0 and < 1.5.0.4","≥ 1.1.0.0 and < 1.4.3.5"]},{"vendor":"ibm","product":"workload_deployer","ranges":["≥ 3.1.0 and ≤ 3.1.0.7"]},{"vendor":"mageia","product":"mageia","ranges":["4.0","3.0"]},{"vendor":"novell","product":"open_enterprise_server","ranges":["2.0","11.0"]},{"vendor":"novell","product":"zenworks_configuration_management","ranges":["11.1","10.3","11","11.2","11.3.0"]},{"vendor":"opensuse","product":"opensuse","ranges":["13.1","13.2","12.3"]},{"vendor":"oracle","product":"linux","ranges":["5","4","6"]},{"vendor":"qnap","product":"qts","ranges":["< 4.1.1","4.1.1"]},{"vendor":"redhat","product":"enterprise_linux","ranges":["7.0","4.0","5.0","6.0"]},{"vendor":"redhat","product":"enterprise_linux_desktop","ranges":["5.0","6.0","7.0"]},{"vendor":"redhat","product":"enterprise_linux_eus","ranges":["5.9","6.4","6.5","7.3","7.4","7.5","7.6","7.7"]},{"vendor":"redhat","product":"enterprise_linux_for_ibm_z_systems","ranges":["7.6_s390x","5.9_s390x","6.4_s390x","6.5_s390x","7.3_s390x","7.4_s390x","7.5_s390x","7.7_s390x"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian","ranges":["7.0_ppc64","6.4_ppc64","6.0_ppc64","5.9_ppc","5.0_ppc"]},{"vendor":"redhat","product":"enterprise_linux_for_power_big_endian_eus","ranges":["7.5_ppc64","7.4_ppc64","7.3_ppc64","6.5_ppc64","7.6_ppc64","7.7_ppc64"]},{"vendor":"redhat","product":"enterprise_linux_for_scientific_computing","ranges":["6.0","7.0"]},{"vendor":"redhat","product":"enterprise_linux_server","ranges":["6.0","5.0","7.0"]},{"vendor":"redhat","product":"enterprise_linux_server_aus","ranges":["7.3","5.6","5.9","6.2","6.4","7.7","7.6","7.4","6.5"]},{"vendor":"redhat","product":"enterprise_linux_server_from_rhui","ranges":["7.0","5.0","6.0"]},{"vendor":"redhat","product":"enterprise_linux_server_tus","ranges":["7.7","6.5","7.3","7.6"]},{"vendor":"redhat","product":"enterprise_linux_workstation","ranges":["5.0","7.0","6.0"]},{"vendor":"redhat","product":"gluster_storage_server_for_on-premise","ranges":["2.1"]},{"vendor":"redhat","product":"virtualization","ranges":["3.4"]},{"vendor":"suse","product":"linux_enterprise_desktop","ranges":["12","11"]},{"vendor":"suse","product":"linux_enterprise_server","ranges":["10","12","11"]},{"vendor":"suse","product":"linux_enterprise_software_development_kit","ranges":["12","11"]},{"vendor":"suse","product":"studio_onsite","ranges":["1.3"]},{"vendor":"vmware","product":"esx","ranges":["4.0","4.1"]},{"vendor":"vmware","product":"vcenter_server_appliance","ranges":["5.0","5.1","5.5"]}]}