3 ms·
Yeah, I am not sure why there is so much hype. From what I can tell you are affected only if you use CGI or the like somewhere in your response chain. AFAIK mo
by general_failure 12y ago
Yeah, I am not sure why there is so much hype.
From what I can tell you are affected only if you use CGI or the like somewhere in your response chain. AFAIK most people use http reverse proxies, phpfm, wsgi and the like. They are all unaffected.
- epochwolf 12y agoThere's a lot of older web applications that run via cgi.
- nitrogen 12y agoIt is not just CGI. It is any process that uses user-controlled environment variables anywhere, that later eventually happens to call something that calls something that calls system() or executes a shell script. So CUPS printer servers at universities may be vulnerable. Dhclient may be vulnerable to malicious DHCP responses. Anything that calls out may be vulnerable (lots of mail libraries actually call /usr/bin/sendmail or the like; better hope they don't use system() or a bash /bin/sh to do it). This is a big deal because there's a ton of stuff that uses environment variables that is and is not a web server, and very little time to track it all down before a black hat or oppressive regime gets there first.