Chet (bash maintainer) has indicated that this issue is different to the original CVE. The problem is the first issue altered people to the fact the the functi

Chet (bash maintainer) has indicated that this issue is different to the original CVE. The problem is the first issue altered people to the fact the the function var parsing was a interesting previously-unpublicized attack vector, and they started looking for more funkiness there. It would have been nice if the response to the first issue had been to do a thorough and complete testing of the parsing code, but it's not really surprising that it wasn't.