ALPINE-CVE-2016-0634 PUBLISHED CVSS 7.5 HIGH

The expansion of '\h' in the prompt string in bash 4.3 allows remote authenticated users to execute arbitrary code via shell metacharacters placed in 'hostname' of a machine.

Risk Scores

CVSS v3.0
7.5
CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersions
Alpine:v3.11bash4.4.12-r0, 0, 4.0.035-r0
Alpine:v3.17bash4.4.12-r0, 4.3.48-r2, 4.3.48-r1
Alpine:v3.13bash0, 4.2.024-r0, 4.2.028-r0
Alpine:v3.18bash4.3.48-r1, 4.3.48-r0, 4.3.46-r4
Alpine:v3.8bash4.3.011-r2, 4.4.12-r0, 4.3.48-r2
Alpine:v3.12bash4.2.008-r0, 4.2.010-r0, 4.2.020-r0
Alpine:v3.15bash0, 4.2.042-r0, 4.2.045-r0
Alpine:v3.19bash4.4.12-r0, 4.3.48-r2, 4.3.48-r1
Alpine:v3.16bash4.4.12-r0, 4.3.48-r2, 4.3.48-r1
Alpine:v3.22bash0, 4.4.12-r0, 4.3.48-r2
Alpine:v3.21bash4.0.035-r0, 4.1.002-r0, 4.1.005-r0
Alpine:v3.14bash4.4.12-r0, 4.2.036-r0, 4.2.037-r0
Alpine:v3.9bash4.0.035-r0, 4.4.12-r0, 4.3.48-r2
Alpine:v3.10bash4.0.035-r0, 4.1.002-r0, 4.1.005-r0
Alpine:v3.23bash4.3.011-r2, 0, 4.0.035-r0
Alpine:v3.7bash4.4.12-r0, 4.3.48-r2, 4.3.48-r1
Alpine:v3.20bash4.4.12-r0, 0, 4.0.035-r0

Timeline

References

Open in Interactive Console →