3 ms·
Ubuntu patched CVE-2014-6277 and CVE-2014-6278 today: http://www.ubuntu.com/usn/usn-2380-1/ http://www.ubuntu.com/usn/usn-2380-1/ Red Hat's initial patches we
by antoncohen 12y ago
Ubuntu patched CVE-2014-6277 and CVE-2014-6278 today:
http://www.ubuntu.com/usn/usn-2380-1/ http://www.ubuntu.com/usn/usn-2380-1/
Red Hat's initial patches were more complete than upstream's patches, so updated Red Hat (and CentOS) systems are not vulnerable to CVE-2014-6277 and CVE-2014-6278. RH still contains the parsing bug(s) which is why the Shellshock test script shows a problem, but there is no known exploit so they consider it a regular bug and not a security bug:
https://bugzilla.redhat.com/show_bug.cgi?id=1147189 https://bugzilla.redhat.com/show_bug.cgi?id=1147189
https://bugzilla.redhat.com/show_bug.cgi?id=1147414 https://bugzilla.redhat.com/show_bug.cgi?id=1147414