4 ms·

Debian patched this 8 hours ago, Redhat issued a patch about 3 hours ago, I believe Centos is still vulnerable, Ubuntu 14.10 isn't patched yet, Ubuntu 14.04 was

• psgbg 12y ago
  I'm using debian jessie (testing) i386, and I had to download bash myself (from sid) because my up-to-date system was affected but the first patch was available for sid (unstable) and wheezy (stable) and not in jessie. So I don't know if every architecture, and version is updated with the same speed.
  • mrmondo 12y ago
    Jessie isn't released / stable and doesn't receive security patches until it is. It's called testing for a reason.
    • bigbugbag 12y ago
      debian testing do receive security patches, but it is not a priority so they may not get there in a timely manner.
      • psgbg 12y ago
        Yeah. I'm aware that stable and old stable need to be patched first, I was just surprised by how much time it took considering the kind of risk (and being beaten by sid, the kid whom always breaks his toys).
• ScottBurson 12y ago
  I did 'yum update bash' on my Centos 5.8 Linode a couple of hours ago, and it updated to 3.2-33 and is apparently no longer vulnerable, according to the one-line test I have been using: X="() { :;} ; echo busted" /bin/sh -c "echo stuff"
  • gklyne 12y ago
    That test doesn't detect the vulnerability - needs to mention /bin/bash not /bin/sh
    • bigbugbag 12y ago
      Well, maybe you should look at your /bin/sh ls -l /bin/sh lrwxrwxrwx 1 root root 4 Sep 24 08:07 /bin/sh -> bash
      • makomk 12y ago
        I think /bin/sh is /bin/bash on CentOS and RedHat, but Debian, Ubuntu and probably other distros use dash as /bin/sh instead which was never vulnerable.
• pandog 12y ago
  Looks like 14.10 is patched now
• darkr 12y ago
  CentOS released a patched bash package around 2AM GMT, something like an hour after RedHat.