CISA Known Exploited Vulnerability

CVE-2014-6271

GNU · Bourne-Again Shell (Bash)

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Date added 2022-01-28

BOD 22-01 due date 2022-07-28

CWE CWE-78

Ransomware Unknown

CISA description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.

Required action

Apply updates per vendor instructions.

Notes & references

https://nvd.nist.gov/vuln/detail/CVE-2014-6271

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2014-6271
CVE.org · CVE-2014-6271
CISA KEV catalog (canonical)