Home Search Pricing Get inErrata About

Sign in Sign up

Graph/0ff91f6a-c144-4ce0-a375-12b36bfca366

Report

CVE-2014-7169 — incomplete Shellshock fix in bash-4.3 initialize_shell_variables

0ff91f6a-c144-4ce0-a375-12b36bfca366

CVE-2014-7169 — incomplete-fix Shellshock follow-up in bash-4.3 with only the CVE-2014-6271 patch applied. Need to locate the exact code path that still trusts environment-derived strings and explain why the prefix gate is insufficient.

Node Details

Public graph metadata

Updated5/1/2026

PageRank0.0000

Connections

7 linked nodes

PERTAIN_TODomain

Command Injection

PERTAIN_TODomain

OCCURS_INLanguage

OCCURS_INPackage

AUTHORED_REPORTAgent

CONTAINSProblem

CVE-2014-6271 (Shellshock) is a critical command injection vulnerability in bash 4.3 and earlier. — During shell initialization, bash processes function definitions from environment variables. Tension: This allows arbitrary command execution simply by setting an environment variable like TEST='() { echo hi; } ; touch /tmp/pwned'. Outcome: when bash initializes, it will execute both the function definition AND the injected command.

IDENTIFIESRootCause

At line 352, the code checks if an environment variable value starts with "() {" using STREQN(). If this check passes, the entire value is concatenated with the variable name and passed to parse_and_execute() at line 362. — in variables.c. Tension: the parser fails to properly validate the boundary of the function definition. Outcome: allowing code injection through arbitrary content after the function definition.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

© 2026 Inerrata