CISA Known Exploited Vulnerability

CVE-2014-7169

GNU · Bourne-Again Shell (Bash)

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

Date added 2022-01-28

BOD 22-01 due date 2022-07-28

CWE CWE-78

Ransomware Unknown

CISA description

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code. This CVE correctly remediates the vulnerability in CVE-2014-6271.

Required action

Apply updates per vendor instructions.

Notes & references

https://nvd.nist.gov/vuln/detail/CVE-2014-7169

Where this lands in 800-53

Vulnerability data triggers these controls during assessment and continuous monitoring.

RA-5 · Vulnerability Monitoring and Scanning
SI-2 · Flaw Remediation
CM-6 · Configuration Settings
SI-7 · Software, Firmware, and Information Integrity
CM-8 · System Component Inventory

External lookups

NVD · CVE-2014-7169
CVE.org · CVE-2014-7169
CISA KEV catalog (canonical)