CVE-2016-0634 - Vulnerability Details

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:M/Au:S/C:P/I:P/A:P

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Gnu	Bash
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 6
bash-0:4.1.2-48.el6	cpe:/o:redhat:enterprise_linux:6	RHSA-2017:0725	2017-03-21T00:00:00Z
Red Hat Enterprise Linux 7
bash-0:4.2.46-28.el7	cpe:/o:redhat:enterprise_linux:7	RHSA-2017:1931	2017-08-01T00:00:00Z

References

Link	Providers
http://rhn.redhat.com/errata/RHSA-2017-0725.html
http://www.openwall.com/lists/oss-security/2016/09/16/12
http://www.openwall.com/lists/oss-security/2016/09/16/8
http://www.openwall.com/lists/oss-security/2016/09/18/11
http://www.openwall.com/lists/oss-security/2016/09/19/7
http://www.openwall.com/lists/oss-security/2016/09/20/1
http://www.openwall.com/lists/oss-security/2016/09/27/9
http://www.openwall.com/lists/oss-security/2016/09/29/27
http://www.openwall.com/lists/oss-security/2016/10/07/6
http://www.openwall.com/lists/oss-security/2016/10/10/3
http://www.openwall.com/lists/oss-security/2016/10/10/4
http://www.securityfocus.com/bid/92999
https://access.redhat.com/errata/RHSA-2017:1931
https://bugzilla.redhat.com/show_bug.cgi?id=1377613
https://nvd.nist.gov/vuln/detail/CVE-2016-0634
https://security.gentoo.org/glsa/201612-39
https://www.cve.org/CVERecord?id=CVE-2016-0634

History

Mon, 07 Oct 2024 19:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: oracle

Published: 2017-08-28T15:00:00

Updated: 2024-10-04T17:00:57.944Z

Reserved: 2015-12-09T00:00:00

Link: CVE-2016-0634

Vulnrichment

Updated: 2024-08-05T22:22:55.842Z

NVD

Status : Deferred

Published: 2017-08-28T15:29:01.487

Modified: 2025-04-20T01:37:25.860

Link: CVE-2016-0634

Redhat

Severity : Moderate

Publid Date: 2015-10-16T00:00:00Z

Links: CVE-2016-0634 - Bugzilla

Show plain JSON

{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-09-16T00:00:00", "descriptions": [{"lang": "en", "value": "The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-01-04T19:57:01", "orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle"}, "references": [{"name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/27/9"}, {"name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/8"}, {"name": "RHSA-2017:0725", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html"}, {"name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/29/27"}, {"name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/20/1"}, {"name": "92999", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/92999"}, {"name": "RHSA-2017:1931", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "https://access.redhat.com/errata/RHSA-2017:1931"}, {"name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/10/07/6"}, {"name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/18/11"}, {"name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/19/7"}, {"name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/4"}, {"name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/12"}, {"name": "GLSA-201612-39", "tags": ["vendor-advisory", "x_refsource_GENTOO"], "url": "https://security.gentoo.org/glsa/201612-39"}, {"tags": ["x_refsource_CONFIRM"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, {"name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/3"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secalert_us@oracle.com", "ID": "CVE-2016-0634", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/27/9"}, {"name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/16/8"}, {"name": "RHSA-2017:0725", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html"}, {"name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/29/27"}, {"name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/20/1"}, {"name": "92999", "refsource": "BID", "url": "http://www.securityfocus.com/bid/92999"}, {"name": "RHSA-2017:1931", "refsource": "REDHAT", "url": "https://access.redhat.com/errata/RHSA-2017:1931"}, {"name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/10/07/6"}, {"name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/18/11"}, {"name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/19/7"}, {"name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/10/10/4"}, {"name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/09/16/12"}, {"name": "GLSA-201612-39", "refsource": "GENTOO", "url": "https://security.gentoo.org/glsa/201612-39"}, {"name": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613", "refsource": "CONFIRM", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, {"name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST", "url": "http://www.openwall.com/lists/oss-security/2016/10/10/3"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:22:55.842Z"}, "title": "CVE Program Container", "references": [{"name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/27/9"}, {"name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/8"}, {"name": "RHSA-2017:0725", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html"}, {"name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/29/27"}, {"name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/20/1"}, {"name": "92999", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/92999"}, {"name": "RHSA-2017:1931", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "https://access.redhat.com/errata/RHSA-2017:1931"}, {"name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/10/07/6"}, {"name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/18/11"}, {"name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/19/7"}, {"name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/4"}, {"name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/12"}, {"name": "GLSA-201612-39", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"], "url": "https://security.gentoo.org/glsa/201612-39"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, {"name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/3"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-04T15:39:15.651571Z", "id": "CVE-2016-0634", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T17:00:57.944Z"}}]}, "cveMetadata": {"assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "assignerShortName": "oracle", "cveId": "CVE-2016-0634", "datePublished": "2017-08-28T15:00:00", "dateReserved": "2015-12-09T00:00:00", "dateUpdated": "2024-10-04T17:00:57.944Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

affected : [ »

0 : { »

product : n/a (string)

vendor : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-09-16T00:00:00 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : n/a (string)

lang : en (string)

type : text (string)

}

]

}

]

providerMetadata : { »

dateUpdated : 2018-01-04T19:57:01 (string)

orgId : 43595867-4340-4103-b7a2-9a5208d29a85 (string)

shortName : oracle (string)

}

references : [ »

0 : { »

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

}

1 : { »

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

}

2 : { »

name : RHSA-2017:0725 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

}

3 : { »

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

}

4 : { »

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

}

5 : { »

name : 92999 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

url : http://www.securityfocus.com/bid/92999 (string)

}

6 : { »

name : RHSA-2017:1931 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

}

7 : { »

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

}

8 : { »

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

}

9 : { »

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

}

10 : { »

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

}

11 : { »

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

}

12 : { »

name : GLSA-201612-39 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

]

url : https://security.gentoo.org/glsa/201612-39 (string)

}

13 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

14 : { »

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

}

]

x_legacyV4Record : { »

CVE_data_meta : { »

ASSIGNER : secalert_us@oracle.com (string)

ID : CVE-2016-0634 (string)

STATE : PUBLIC (string)

}

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

product_name : n/a (string)

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

]

}

vendor_name : n/a (string)

}

]

}

data_format : MITRE (string)

data_type : CVE (string)

data_version : 4.0 (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

references : { »

reference_data : [ »

0 : { »

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

}

1 : { »

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

}

2 : { »

name : RHSA-2017:0725 (string)

refsource : REDHAT (string)

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

}

3 : { »

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

}

4 : { »

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

}

5 : { »

name : 92999 (string)

refsource : BID (string)

url : http://www.securityfocus.com/bid/92999 (string)

}

6 : { »

name : RHSA-2017:1931 (string)

refsource : REDHAT (string)

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

}

7 : { »

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

}

8 : { »

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

}

9 : { »

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

}

10 : { »

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

}

11 : { »

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

}

12 : { »

name : GLSA-201612-39 (string)

refsource : GENTOO (string)

url : https://security.gentoo.org/glsa/201612-39 (string)

}

13 : { »

name : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

refsource : CONFIRM (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

14 : { »

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T22:22:55.842Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

}

1 : { »

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

}

2 : { »

name : RHSA-2017:0725 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

}

3 : { »

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

}

4 : { »

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

}

5 : { »

name : 92999 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

url : http://www.securityfocus.com/bid/92999 (string)

}

6 : { »

name : RHSA-2017:1931 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

}

7 : { »

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

}

8 : { »

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

}

9 : { »

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

}

10 : { »

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

}

11 : { »

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

}

12 : { »

name : GLSA-201612-39 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

2 : x_transferred (string)

]

url : https://security.gentoo.org/glsa/201612-39 (string)

}

13 : { »

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

14 : { »

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-04T15:39:15.651571Z (string)

id : CVE-2016-0634 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-04T17:00:57.944Z (string)

}

]

}

cveMetadata : { »

assignerOrgId : 43595867-4340-4103-b7a2-9a5208d29a85 (string)

assignerShortName : oracle (string)

cveId : CVE-2016-0634 (string)

datePublished : 2017-08-28T15:00:00 (string)

dateReserved : 2015-12-09T00:00:00 (string)

dateUpdated : 2024-10-04T17:00:57.944Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2016/09/27/9", "name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/8", "name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html", "name": "RHSA-2017:0725", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/29/27", "name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/20/1", "name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.securityfocus.com/bid/92999", "name": "92999", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:1931", "name": "RHSA-2017:1931", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/07/6", "name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/18/11", "name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/19/7", "name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/4", "name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/12", "name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/201612-39", "name": "GLSA-201612-39", "tags": ["vendor-advisory", "x_refsource_GENTOO", "x_transferred"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/3", "name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T22:22:55.842Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2016-0634", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-04T15:39:15.651571Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-04T15:39:23.704Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2016-09-16T00:00:00", "references": [{"url": "http://www.openwall.com/lists/oss-security/2016/09/27/9", "name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/8", "name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html", "name": "RHSA-2017:0725", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/29/27", "name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/20/1", "name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.securityfocus.com/bid/92999", "name": "92999", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "https://access.redhat.com/errata/RHSA-2017:1931", "name": "RHSA-2017:1931", "tags": ["vendor-advisory", "x_refsource_REDHAT"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/07/6", "name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/18/11", "name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/19/7", "name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/4", "name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/12", "name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}, {"url": "https://security.gentoo.org/glsa/201612-39", "name": "GLSA-201612-39", "tags": ["vendor-advisory", "x_refsource_GENTOO"]}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/3", "name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "tags": ["mailing-list", "x_refsource_MLIST"]}], "descriptions": [{"lang": "en", "value": "The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "43595867-4340-4103-b7a2-9a5208d29a85", "shortName": "oracle", "dateUpdated": "2018-01-04T19:57:01"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "n/a"}]}, "product_name": "n/a"}]}, "vendor_name": "n/a"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "http://www.openwall.com/lists/oss-security/2016/09/27/9", "name": "[oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/8", "name": "[oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html", "name": "RHSA-2017:0725", "refsource": "REDHAT"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/29/27", "name": "[oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/20/1", "name": "[oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.securityfocus.com/bid/92999", "name": "92999", "refsource": "BID"}, {"url": "https://access.redhat.com/errata/RHSA-2017:1931", "name": "RHSA-2017:1931", "refsource": "REDHAT"}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/07/6", "name": "[oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/18/11", "name": "[oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/19/7", "name": "[oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/4", "name": "[oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "http://www.openwall.com/lists/oss-security/2016/09/16/12", "name": "[oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}, {"url": "https://security.gentoo.org/glsa/201612-39", "name": "GLSA-201612-39", "refsource": "GENTOO"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613", "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2016/10/10/3", "name": "[oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME", "refsource": "MLIST"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2016-0634", "STATE": "PUBLIC", "ASSIGNER": "secalert_us@oracle.com"}}}}, "cveMetadata": {"cveId": "CVE-2016-0634", "state": "PUBLISHED", "dateUpdated": "2024-10-04T17:00:57.944Z", "dateReserved": "2015-12-09T00:00:00", "assignerOrgId": "43595867-4340-4103-b7a2-9a5208d29a85", "datePublished": "2017-08-28T15:00:00", "assignerShortName": "oracle"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

2 : { »

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

name : RHSA-2017:0725 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

3 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

4 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

5 : { »

url : http://www.securityfocus.com/bid/92999 (string)

name : 92999 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

2 : x_transferred (string)

]

}

6 : { »

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

name : RHSA-2017:1931 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

2 : x_transferred (string)

]

}

7 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

8 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

9 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

10 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

11 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

12 : { »

url : https://security.gentoo.org/glsa/201612-39 (string)

name : GLSA-201612-39 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

2 : x_transferred (string)

]

}

13 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

1 : x_transferred (string)

]

}

14 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

2 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-05T22:22:55.842Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2016-0634 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-04T15:39:15.651571Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-04T15:39:23.704Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : n/a (string)

product : n/a (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

}

]

}

]

datePublic : 2016-09-16T00:00:00 (string)

references : [ »

0 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

2 : { »

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

name : RHSA-2017:0725 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

3 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

4 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

5 : { »

url : http://www.securityfocus.com/bid/92999 (string)

name : 92999 (string)

tags : [ »

0 : vdb-entry (string)

1 : x_refsource_BID (string)

]

}

6 : { »

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

name : RHSA-2017:1931 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_REDHAT (string)

]

}

7 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

8 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

9 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

10 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

11 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

12 : { »

url : https://security.gentoo.org/glsa/201612-39 (string)

name : GLSA-201612-39 (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_refsource_GENTOO (string)

]

}

13 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

tags : [ »

0 : x_refsource_CONFIRM (string)

]

}

14 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

tags : [ »

0 : mailing-list (string)

1 : x_refsource_MLIST (string)

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : text (string)

description : n/a (string)

}

]

}

]

providerMetadata : { »

orgId : 43595867-4340-4103-b7a2-9a5208d29a85 (string)

shortName : oracle (string)

dateUpdated : 2018-01-04T19:57:01 (string)

}

x_legacyV4Record : { »

affects : { »

vendor : { »

vendor_data : [ »

0 : { »

product : { »

product_data : [ »

0 : { »

version : { »

version_data : [ »

0 : { »

version_value : n/a (string)

}

]

}

product_name : n/a (string)

}

]

}

vendor_name : n/a (string)

}

]

}

data_type : CVE (string)

references : { »

reference_data : [ »

0 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

name : [oss-security] 20160927 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

1 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

name : [oss-security] 20160916 CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

2 : { »

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

name : RHSA-2017:0725 (string)

refsource : REDHAT (string)

}

3 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

name : [oss-security] 20160929 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

4 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

name : [oss-security] 20160920 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

5 : { »

url : http://www.securityfocus.com/bid/92999 (string)

name : 92999 (string)

refsource : BID (string)

}

6 : { »

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

name : RHSA-2017:1931 (string)

refsource : REDHAT (string)

}

7 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

name : [oss-security] 20161007 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

8 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

name : [oss-security] 20160918 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

9 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

name : [oss-security] 20160919 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

10 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

name : [oss-security] 20161010 Re: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

11 : { »

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

name : [oss-security] 20160916 Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

12 : { »

url : https://security.gentoo.org/glsa/201612-39 (string)

name : GLSA-201612-39 (string)

refsource : GENTOO (string)

}

13 : { »

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

name : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

refsource : CONFIRM (string)

}

14 : { »

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

name : [oss-security] 20161010 RE: Re: CVE-2016-0634 -- bash prompt expanding $HOSTNAME (string)

refsource : MLIST (string)

}

]

}

data_format : MITRE (string)

description : { »

description_data : [ »

0 : { »

lang : eng (string)

value : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

}

]

}

problemtype : { »

problemtype_data : [ »

0 : { »

description : [ »

0 : { »

lang : eng (string)

value : n/a (string)

}

]

}

]

}

data_version : 4.0 (string)

CVE_data_meta : { »

ID : CVE-2016-0634 (string)

STATE : PUBLIC (string)

ASSIGNER : secalert_us@oracle.com (string)

}

cveMetadata : { »

cveId : CVE-2016-0634 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-04T17:00:57.944Z (string)

dateReserved : 2015-12-09T00:00:00 (string)

assignerOrgId : 43595867-4340-4103-b7a2-9a5208d29a85 (string)

datePublished : 2017-08-28T15:00:00 (string)

assignerShortName : oracle (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:*", "matchCriteriaId": "BC1DAC9F-711C-47EA-9BBC-0EDB2AF0A1AC", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine."}, {"lang": "es", "value": "La expansi\u00f3n de \\h en la l\u00ednea de comandos en bash 4.3 permite a los usuarios autenticados remotos ejecutar c\u00f3digo arbitrario mediante metacaracteres shell ubicados en 'hostname' de la m\u00e1quina."}], "id": "CVE-2016-0634", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 6.8, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV30": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2017-08-28T15:29:01.487", "references": [{"source": "secalert_us@oracle.com", "url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/12"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/8"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/18/11"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/19/7"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/20/1"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/27/9"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/29/27"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/07/6"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/3"}, {"source": "secalert_us@oracle.com", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/4"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/92999"}, {"source": "secalert_us@oracle.com", "url": "https://access.redhat.com/errata/RHSA-2017:1931"}, {"source": "secalert_us@oracle.com", "tags": ["Issue Tracking", "Patch", "Third Party Advisory", "VDB Entry"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, {"source": "secalert_us@oracle.com", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201612-39"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://rhn.redhat.com/errata/RHSA-2017-0725.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/12"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Patch", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/16/8"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/18/11"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/19/7"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/20/1"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/27/9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/09/29/27"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/07/6"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/3"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Mailing List", "Third Party Advisory"], "url": "http://www.openwall.com/lists/oss-security/2016/10/10/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/92999"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://access.redhat.com/errata/RHSA-2017:1931"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking", "Patch", "Third Party Advisory", "VDB Entry"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/201612-39"}], "sourceIdentifier": "secalert_us@oracle.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:gnu:bash:4.3:*:*:*:*:*:*:* (string)

matchCriteriaId : BC1DAC9F-711C-47EA-9BBC-0EDB2AF0A1AC (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

}

1 : { »

lang : es (string)

value : La expansión de \h en la línea de comandos en bash 4.3 permite a los usuarios autenticados remotos ejecutar código arbitrario mediante metacaracteres shell ubicados en 'hostname' de la máquina. (string)

}

]

id : CVE-2016-0634 (string)

lastModified : 2025-04-20T01:37:25.860 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : SINGLE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:S/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 6.8 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : false (boolean)

}

]

cvssMetricV30 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : LOW (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.0 (string)

}

exploitabilityScore : 1.6 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

published : 2017-08-28T15:29:01.487 (string)

references : [ »

0 : { »

source : secalert_us@oracle.com (string)

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

}

1 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

}

2 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Patch (string)

2 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

}

3 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

}

4 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

}

5 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

}

6 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

}

7 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

}

8 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

}

9 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

}

10 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

}

11 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/92999 (string)

}

12 : { »

source : secalert_us@oracle.com (string)

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

}

13 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

2 : Third Party Advisory (string)

3 : VDB Entry (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

14 : { »

source : secalert_us@oracle.com (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.gentoo.org/glsa/201612-39 (string)

}

15 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : http://rhn.redhat.com/errata/RHSA-2017-0725.html (string)

}

16 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/12 (string)

}

17 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Patch (string)

2 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/16/8 (string)

}

18 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/18/11 (string)

}

19 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/19/7 (string)

}

20 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/20/1 (string)

}

21 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/27/9 (string)

}

22 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/09/29/27 (string)

}

23 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/07/6 (string)

}

24 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/3 (string)

}

25 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Mailing List (string)

1 : Third Party Advisory (string)

]

url : http://www.openwall.com/lists/oss-security/2016/10/10/4 (string)

}

26 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

1 : VDB Entry (string)

]

url : http://www.securityfocus.com/bid/92999 (string)

}

27 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

url : https://access.redhat.com/errata/RHSA-2017:1931 (string)

}

28 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Issue Tracking (string)

1 : Patch (string)

2 : Third Party Advisory (string)

3 : VDB Entry (string)

]

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

29 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.gentoo.org/glsa/201612-39 (string)

}

]

sourceIdentifier : secalert_us@oracle.com (string)

vulnStatus : Deferred (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-78 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"affected_release": [{"advisory": "RHSA-2017:0725", "cpe": "cpe:/o:redhat:enterprise_linux:6", "package": "bash-0:4.1.2-48.el6", "product_name": "Red Hat Enterprise Linux 6", "release_date": "2017-03-21T00:00:00Z"}, {"advisory": "RHSA-2017:1931", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "bash-0:4.2.46-28.el7", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2017-08-01T00:00:00Z"}], "bugzilla": {"description": "bash: Arbitrary code execution via malicious hostname", "id": "1377613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1377613"}, "csaw": false, "cvss": {"cvss_base_score": "3.7", "cvss_scoring_vector": "AV:L/AC:H/Au:N/C:P/I:P/A:P", "status": "verified"}, "cvss3": {"cvss3_base_score": "4.9", "cvss3_scoring_vector": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "status": "verified"}, "details": ["The expansion of '\\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.", "An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances."], "name": "CVE-2016-0634", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:5", "fix_state": "Will not fix", "package_name": "bash", "product_name": "Red Hat Enterprise Linux 5"}], "public_date": "2015-10-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2016-0634\nhttps://nvd.nist.gov/vuln/detail/CVE-2016-0634"], "threat_severity": "Moderate"}

{

affected_release : [ »

0 : { »

advisory : RHSA-2017:0725 (string)

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

package : bash-0:4.1.2-48.el6 (string)

product_name : Red Hat Enterprise Linux 6 (string)

release_date : 2017-03-21T00:00:00Z (string)

}

1 : { »

advisory : RHSA-2017:1931 (string)

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

package : bash-0:4.2.46-28.el7 (string)

product_name : Red Hat Enterprise Linux 7 (string)

release_date : 2017-08-01T00:00:00Z (string)

}

]

bugzilla : { »

description : bash: Arbitrary code execution via malicious hostname (string)

id : 1377613 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=1377613 (string)

}

csaw : false (boolean)

cvss : { »

cvss_base_score : 3.7 (string)

cvss_scoring_vector : AV:L/AC:H/Au:N/C:P/I:P/A:P (string)

status : verified (string)

}

cvss3 : { »

cvss3_base_score : 4.9 (string)

cvss3_scoring_vector : CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L (string)

status : verified (string)

}

details : [ »

0 : The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine. (string)

1 : An arbitrary command injection flaw was found in the way bash processed the hostname value. A malicious DHCP server could use this flaw to execute arbitrary commands on the DHCP client machines running bash under specific circumstances. (string)

]

name : CVE-2016-0634 (string)

package_state : [ »

0 : { »

cpe : cpe:/o:redhat:enterprise_linux:5 (string)

fix_state : Will not fix (string)

package_name : bash (string)

product_name : Red Hat Enterprise Linux 5 (string)

}

]

public_date : 2015-10-16T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2016-0634 https://nvd.nist.gov/vuln/detail/CVE-2016-0634 (string)

]

threat_severity : Moderate (string)

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object