Homepage

OS Command Injection The advisory has been revoked - it doesn't affect any version of package rhel-guest-image  (opens in a new tab)

Threat Intelligence

Exploit Maturity
Attacked
EPSS
100% (100th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS7-RHELGUESTIMAGE-2833712
  • published26 Jul 2021
  • disclosed24 Sept 2014
Report a new vulnerability Found a mistake?

Introduced: 24 Sep 2014

CVE-2014-6271  (opens in a new tab)
CWE-78  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:7.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rhel-guest-image package and not the rhel-guest-image package as distributed by Centos.

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

References