CVE-2014-6278highunder attackCWE-78

CVE-2014-6278

Published · Updated

Follow this CVE+ Monitor GNU Bash+ Monitor bash

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 8.8epss 100%
from disclosure to weaponsame day
Published on NVDSep 30
1st PoCSep 29
metasploitSep 24
CISA KEV+4020d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Not affected
4 products (8 components) — because the vulnerable code is not present in the product
Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 4 · Red Hat Enterprise Linux 5
Action required by CISAfederal deadline: 2025-10-23

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Bash shell has a critical vulnerability where attackers can execute arbitrary commands by crafting malicious environment variables with fake function definitions. This is especially dangerous in systems like SSH and web servers that pass environment data to Bash.

Technical detail

CVE-2014-6278 is a command injection vulnerability in GNU Bash through 4.3 where improper parsing of function definitions in environment variables allows remote code execution when Bash processes attacker-controlled environment data across privilege boundaries. Attack vectors include OpenSSH ForceCommand, Apache mod_cgi/mod_cgid, and DHCP clients; exploitation requires ability to set environment variables in a context where Bash will parse them.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271, CVE-2014-7169, and CVE-2014-6277.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.