GHSA-56xr-5j9v-w2wh

GHSA-56xr-5j9v-w2wh PUBLISHED CVSS 7.800000190734863 HIGH

Record from GitHub Advisory Database · Published May 13, 2022

rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.

Risk scores

CVSS 3.1

7.800000190734863

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

May 13, 2022 CVE Published
Apr 29, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-56xr-5j9v-w2wh
vulnetix vdb fixes GHSA-56xr-5j9v-w2wh

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-56xr-5j9v-w2wh/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

https://usn.ubuntu.com/4058-1 url
https://usn.ubuntu.com/4058-2 url
https://nvd.nist.gov/vuln/detail/CVE-2019-9924 advisory
https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441 url
https://lists.debian.org/debian-lts-announce/2019/03/msg00028.html url
https://security.netapp.com/advisory/ntap-20190411-0001 url
http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65 url
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00049.html url

Look up in the Resolve Platform →