CVE-2014-6271
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2014-09-24

Last updated on: 2026-04-22

Assigner: Debian GNU/Linux

Description
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2014-09-24
Last Modified
2026-04-22
Generated
2026-10-16
AI Q&A
2024-11-28
EPSS Evaluated
2025-08-20
NVD
CVE-2014-6271

Affected Vendors & Products

Showing 345 associated CPEs
Vendor Product Version / Range
redhat enterprise_linux_desktop 7.0
apple mac_os_x to 10.14 (inc)
gnu bash to 4.3 (inc)
arista eos From 4.9.0 (inc) to 4.9.12 (exc)
arista eos From 4.10.0 (inc) to 4.10.9 (exc)
arista eos From 4.11.0 (inc) to 4.11.11 (exc)
arista eos From 4.12.0 (inc) to 4.12.9 (exc)
arista eos From 4.13.0 (inc) to 4.13.9 (exc)
arista eos From 4.14.0 (inc) to 4.14.4f (exc)
oracle linux 4
oracle linux 5
oracle linux 6
qnap qts to 4.1.1 (exc)
qnap qts 4.1.1
qnap qts 4.1.1
mageia mageia 3.0
mageia mageia 4.0
redhat gluster_storage_server_for_on-premise 2.1
redhat virtualization 3.4
redhat enterprise_linux 4.0
redhat enterprise_linux 5.0
redhat enterprise_linux 6.0
redhat enterprise_linux 7.0
redhat enterprise_linux_desktop 5.0
redhat enterprise_linux_desktop 6.0
redhat enterprise_linux_eus 5.9
redhat enterprise_linux_eus 6.4
redhat enterprise_linux_eus 6.5
redhat enterprise_linux_eus 7.3
redhat enterprise_linux_eus 7.4
redhat enterprise_linux_eus 7.5
redhat enterprise_linux_eus 7.6
redhat enterprise_linux_eus 7.7
redhat enterprise_linux_for_ibm_z_systems 5.9_s390x
redhat enterprise_linux_for_ibm_z_systems 6.4_s390x
redhat enterprise_linux_for_ibm_z_systems 6.5_s390x
redhat enterprise_linux_for_ibm_z_systems 7.3_s390x
redhat enterprise_linux_for_ibm_z_systems 7.4_s390x
redhat enterprise_linux_for_ibm_z_systems 7.5_s390x
redhat enterprise_linux_for_ibm_z_systems 7.6_s390x
redhat enterprise_linux_for_ibm_z_systems 7.7_s390x
redhat enterprise_linux_for_power_big_endian 5.0_ppc
redhat enterprise_linux_for_power_big_endian 5.9_ppc
redhat enterprise_linux_for_power_big_endian 6.0_ppc64
redhat enterprise_linux_for_power_big_endian 6.4_ppc64
redhat enterprise_linux_for_power_big_endian 7.0_ppc64
redhat enterprise_linux_for_power_big_endian_eus 6.5_ppc64
redhat enterprise_linux_for_power_big_endian_eus 7.3_ppc64
redhat enterprise_linux_for_power_big_endian_eus 7.4_ppc64
redhat enterprise_linux_for_power_big_endian_eus 7.5_ppc64
redhat enterprise_linux_for_power_big_endian_eus 7.6_ppc64
redhat enterprise_linux_for_power_big_endian_eus 7.7_ppc64
redhat enterprise_linux_for_scientific_computing 6.0
redhat enterprise_linux_for_scientific_computing 7.0
redhat enterprise_linux_server 5.0
redhat enterprise_linux_server 6.0
redhat enterprise_linux_server 7.0
redhat enterprise_linux_server_aus 5.6
redhat enterprise_linux_server_aus 5.9
redhat enterprise_linux_server_aus 6.2
redhat enterprise_linux_server_aus 6.4
redhat enterprise_linux_server_aus 6.5
redhat enterprise_linux_server_aus 7.3
redhat enterprise_linux_server_aus 7.4
redhat enterprise_linux_server_aus 7.6
redhat enterprise_linux_server_aus 7.7
redhat enterprise_linux_server_from_rhui 5.0
redhat enterprise_linux_server_from_rhui 6.0
redhat enterprise_linux_server_from_rhui 7.0
redhat enterprise_linux_server_tus 6.5
redhat enterprise_linux_server_tus 7.3
redhat enterprise_linux_server_tus 7.6
redhat enterprise_linux_server_tus 7.7
redhat enterprise_linux_workstation 5.0
redhat enterprise_linux_workstation 6.0
redhat enterprise_linux_workstation 7.0
suse studio_onsite 1.3
opensuse opensuse 12.3
opensuse opensuse 13.1
opensuse opensuse 13.2
suse linux_enterprise_desktop 11
suse linux_enterprise_desktop 12
suse linux_enterprise_server 10
suse linux_enterprise_server 10
suse linux_enterprise_server 11
suse linux_enterprise_server 11
suse linux_enterprise_server 11
suse linux_enterprise_server 11
suse linux_enterprise_server 12
suse linux_enterprise_software_development_kit 11
suse linux_enterprise_software_development_kit 12
debian debian_linux 7.0
ibm infosphere_guardium_database_activity_monitoring 8.2
ibm infosphere_guardium_database_activity_monitoring 9.0
ibm infosphere_guardium_database_activity_monitoring 9.1
ibm pureapplication_system From 1.0.0.0 (inc) to 1.0.0.4 (inc)
ibm pureapplication_system From 1.1.0.0 (inc) to 1.1.0.4 (inc)
ibm pureapplication_system 2.0.0.0
ibm qradar_risk_manager 7.1.0
ibm qradar_security_information_and_event_manager 7.1.0
ibm qradar_security_information_and_event_manager 7.1.0
ibm qradar_security_information_and_event_manager 7.1.0
ibm qradar_security_information_and_event_manager 7.1.1
ibm qradar_security_information_and_event_manager 7.1.1
ibm qradar_security_information_and_event_manager 7.1.1
ibm qradar_security_information_and_event_manager 7.1.1
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.1.2
ibm qradar_security_information_and_event_manager 7.2
ibm qradar_security_information_and_event_manager 7.2.0
ibm qradar_security_information_and_event_manager 7.2.0
ibm qradar_security_information_and_event_manager 7.2.0
ibm qradar_security_information_and_event_manager 7.2.0
ibm qradar_security_information_and_event_manager 7.2.1
ibm qradar_security_information_and_event_manager 7.2.1
ibm qradar_security_information_and_event_manager 7.2.1
ibm qradar_security_information_and_event_manager 7.2.1
ibm qradar_security_information_and_event_manager 7.2.2
ibm qradar_security_information_and_event_manager 7.2.2
ibm qradar_security_information_and_event_manager 7.2.2
ibm qradar_security_information_and_event_manager 7.2.2
ibm qradar_security_information_and_event_manager 7.2.2
ibm qradar_security_information_and_event_manager 7.2.3
ibm qradar_security_information_and_event_manager 7.2.3
ibm qradar_security_information_and_event_manager 7.2.3
ibm qradar_security_information_and_event_manager 7.2.3
ibm qradar_security_information_and_event_manager 7.2.3
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.4
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.5
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.6
ibm qradar_security_information_and_event_manager 7.2.7
ibm qradar_security_information_and_event_manager 7.2.7
ibm qradar_security_information_and_event_manager 7.2.7
ibm qradar_security_information_and_event_manager 7.2.7
ibm qradar_security_information_and_event_manager 7.2.7
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8
ibm qradar_security_information_and_event_manager 7.2.8.15
ibm qradar_security_information_and_event_manager 7.2.9
ibm qradar_vulnerability_manager 7.2.0
ibm qradar_vulnerability_manager 7.2.1
ibm qradar_vulnerability_manager 7.2.2
ibm qradar_vulnerability_manager 7.2.3
ibm qradar_vulnerability_manager 7.2.4
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.6
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm qradar_vulnerability_manager 7.2.8
ibm smartcloud_entry_appliance 2.3.0
ibm smartcloud_entry_appliance 2.4.0
ibm smartcloud_entry_appliance 3.1.0
ibm smartcloud_entry_appliance 3.2.0
ibm smartcloud_provisioning 2.1.0
ibm software_defined_network_for_virtual_environments to 1.2.1 (exc)
ibm software_defined_network_for_virtual_environments to 1.2.1 (exc)
ibm software_defined_network_for_virtual_environments to 1.2.1 (exc)
ibm starter_kit_for_cloud 2.2.0
ibm workload_deployer From 3.1.0 (inc) to 3.1.0.7 (inc)
ibm security_access_manager_for_mobile_8.0_firmware 8.0.0.1
ibm security_access_manager_for_mobile_8.0_firmware 8.0.0.2
ibm security_access_manager_for_mobile_8.0_firmware 8.0.0.3
ibm security_access_manager_for_mobile_8.0_firmware 8.0.0.5
ibm security_access_manager_for_web_7.0_firmware 7.0.0.1
ibm security_access_manager_for_web_7.0_firmware 7.0.0.2
ibm security_access_manager_for_web_7.0_firmware 7.0.0.3
ibm security_access_manager_for_web_7.0_firmware 7.0.0.4
ibm security_access_manager_for_web_7.0_firmware 7.0.0.5
ibm security_access_manager_for_web_7.0_firmware 7.0.0.6
ibm security_access_manager_for_web_7.0_firmware 7.0.0.7
ibm security_access_manager_for_web_7.0_firmware 7.0.0.8
ibm security_access_manager_for_web_8.0_firmware 8.0.0.2
ibm security_access_manager_for_web_8.0_firmware 8.0.0.3
ibm security_access_manager_for_web_8.0_firmware 8.0.0.5
ibm storwize_v7000_firmware From 1.1.0.0 (inc) to 1.4.3.5 (exc)
ibm storwize_v7000_firmware From 1.5.0.0 (inc) to 1.5.0.4 (exc)
ibm storwize_v7000_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm storwize_v7000_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm storwize_v7000 *
ibm storwize_v5000_firmware From 1.1.0.0 (inc) to 7.1.0.11 (exc)
ibm storwize_v5000_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm storwize_v5000_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm storwize_v5000 *
ibm storwize_v3700_firmware From 1.1.0.0 (inc) to 7.1.0.11 (exc)
ibm storwize_v3700_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm storwize_v3700_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm storwize_v3700 *
ibm storwize_v3500_firmware From 1.1.0.0 (inc) to 7.1.0.11 (exc)
ibm storwize_v3500_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm storwize_v3500_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm storwize_v3500 *
ibm flex_system_v7000_firmware From 1.1.0.0 (inc) to 7.1.0.11 (exc)
ibm flex_system_v7000_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm flex_system_v7000_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm flex_system_v7000 *
ibm san_volume_controller_firmware From 1.1.0.0 (inc) to 7.1.0.11 (exc)
ibm san_volume_controller_firmware From 7.2.0.0 (inc) to 7.2.0.9 (exc)
ibm san_volume_controller_firmware From 7.3.0.0 (inc) to 7.3.0.7 (exc)
ibm san_volume_controller *
ibm stn6500_firmware From 3.8.0.0 (inc) to 3.8.0.07 (exc)
ibm stn6500_firmware From 3.9.1.0 (inc) to 3.9.1.08 (exc)
ibm stn6500_firmware From 4.1.2.0 (inc) to 4.1.2.06 (exc)
ibm stn6500 *
ibm stn6800_firmware From 3.8.0.0 (inc) to 3.8.0.07 (exc)
ibm stn6800_firmware From 3.9.1.0 (inc) to 3.9.1.08 (exc)
ibm stn6800_firmware From 4.1.2.0 (inc) to 4.1.2.06 (exc)
ibm stn6800 *
ibm stn7800_firmware From 3.8.0.0 (inc) to 3.8.0.07 (exc)
ibm stn7800_firmware From 3.9.1.0 (inc) to 3.9.1.08 (exc)
ibm stn7800_firmware From 4.1.2.0 (inc) to 4.1.2.06 (exc)
ibm stn7800 *
canonical ubuntu_linux 10.04
canonical ubuntu_linux 12.04
canonical ubuntu_linux 14.04
novell zenworks_configuration_management 10.3
novell zenworks_configuration_management 11
novell zenworks_configuration_management 11.1
novell zenworks_configuration_management 11.2
novell zenworks_configuration_management 11.3.0
novell open_enterprise_server 2.0
novell open_enterprise_server 11.0
checkpoint security_gateway to r77.30 (exc)
f5 big-ip_access_policy_manager From 10.1.0 (inc) to 10.2.4 (inc)
f5 big-ip_access_policy_manager From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_access_policy_manager 11.6.0
f5 big-ip_advanced_firewall_manager From 16.1.0 (inc) to 16.1.5.2.0.7.5 (inc)
f5 big-ip_advanced_firewall_manager 11.6.0
f5 big-ip_analytics From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_analytics 11.6.0
f5 big-ip_application_acceleration_manager From 11.4.0 (inc) to 11.5.1 (inc)
f5 big-ip_application_acceleration_manager 11.6.0
f5 big-ip_application_security_manager From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_application_security_manager From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_application_security_manager 11.6.0
f5 big-ip_edge_gateway From 10.1.0 (inc) to 10.2.4 (inc)
f5 big-ip_edge_gateway From 11.0.0 (inc) to 11.3.0 (inc)
f5 big-ip_global_traffic_manager From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_global_traffic_manager From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_global_traffic_manager 11.6.0
f5 big-ip_link_controller From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_link_controller From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_link_controller 11.6.0
f5 big-ip_local_traffic_manager From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_local_traffic_manager From 11.0.0 (inc) to 11.5.1 (inc)
f5 big-ip_local_traffic_manager 11.6.0
f5 big-ip_policy_enforcement_manager From 11.3.0 (inc) to 11.5.1 (inc)
f5 big-ip_policy_enforcement_manager 11.6.0
f5 big-ip_protocol_security_module From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_protocol_security_module From 11.0.0 (inc) to 11.4.1 (inc)
f5 big-ip_wan_optimization_manager From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_wan_optimization_manager From 11.0.0 (inc) to 11.3.0 (inc)
f5 big-ip_webaccelerator From 10.0.0 (inc) to 10.2.4 (inc)
f5 big-ip_webaccelerator From 11.0.0 (inc) to 11.3.0 (inc)
f5 big-iq_cloud From 4.0.0 (inc) to 4.4.0 (inc)
f5 big-iq_device From 4.2.0 (inc) to 4.4.0 (inc)
f5 big-iq_security From 4.0.0 (inc) to 4.4.0 (inc)
f5 enterprise_manager From 2.1.0 (inc) to 2.3.0 (inc)
f5 enterprise_manager From 3.0.0 (inc) to 3.1.1 (inc)
f5 traffix_signaling_delivery_controller From 4.0.0 (inc) to 4.0.5 (inc)
f5 traffix_signaling_delivery_controller 3.3.2
f5 traffix_signaling_delivery_controller 3.4.1
f5 traffix_signaling_delivery_controller 3.5.1
f5 traffix_signaling_delivery_controller 4.1.0
f5 arx_firmware From 6.0.0 (inc) to 6.4.0 (inc)
f5 arx *
citrix netscaler_sdx_firmware to 9.3.67.5r1 (exc)
citrix netscaler_sdx_firmware From 10 (inc) to 10.1.129.11r1 (exc)
citrix netscaler_sdx_firmware From 10.5 (inc) to 10.5.52.11r1 (exc)
citrix netscaler_sdx *
vmware vcenter_server_appliance 5.0
vmware vcenter_server_appliance 5.0
vmware vcenter_server_appliance 5.0
vmware vcenter_server_appliance 5.1
vmware vcenter_server_appliance 5.1
vmware vcenter_server_appliance 5.1
vmware vcenter_server_appliance 5.5
vmware vcenter_server_appliance 5.5
vmware esx 4.0
vmware esx 4.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability, known as ShellShock, affects GNU Bash versions up to 4.3. It allows attackers to execute arbitrary code by manipulating environment variables. This can happen in various situations, such as when using certain features in OpenSSH or Apache servers, or when scripts are run by DHCP clients. Essentially, it means that if an attacker can set up a specific environment, they can run harmful commands on the system.

Impact Analysis

If you use software that relies on GNU Bash, this vulnerability could allow attackers to take control of your system or execute harmful commands without your permission. This could lead to data breaches, loss of sensitive information, or even complete system compromise.

Compliance Impact

This vulnerability can pose significant risks to compliance with regulations like GDPR and HIPAA, which require organizations to protect sensitive data. If an attacker exploits this vulnerability and gains access to personal or health-related information, it could lead to data breaches, resulting in legal penalties and loss of trust from customers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2014-6271. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart