{"id":"CVE-2019-9924","aliases":["CLSA-2026-1777367927","CLSA-2026-1777446568","DEBIAN-CVE-2019-9924","DLA-1726-1","EUVD-2019-19279","GHSA-56xr-5j9v-w2wh","MGASA-2019-0163","RHSA-2020:1113","RHSA-2020:3474","RHSA-2020:3592","RHSA-2020:3803","SUSE-SU-2019:0838-1","SUSE-SU-2019:0838-2","SUSE-SU-2019:0898-1","UBUNTU-CVE-2019-9924","USN-4058-1","USN-4058-2"],"status":"published","title":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus...","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","severity":{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00402,"percentile":0.34751,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2019-03-22T00:00:00Z","modified":"2026-09-21T07:00:13Z","fixes":[{"ecosystem":"TuxCare:OracleLinux:6","package":"bash","fixed_in":["4.1.2-48.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:OracleLinux:6","package":"bash-doc","fixed_in":["4.1.2-48.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"bash","fixed_in":["4.1.2-48.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:CentOS:6","package":"bash-doc","fixed_in":["4.1.2-48.el6.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"bash","fixed_in":["4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"bash","fixed_in":["4.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"bash","fixed_in":["4.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"bash","fixed_in":["4.3-48.4.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-doc","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-doc","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-doc","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-doc","fixed_in":["0:4.2.46-34.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash-debuginfo","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash-doc","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash-doc","fixed_in":["0:4.2.46-32.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash-doc","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash-doc","fixed_in":["0:4.2.46-34.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash-debuginfo","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash-doc","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash-doc","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash-doc","fixed_in":["0:4.2.46-30.el7_4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 7","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 4","package":"bash","fixed_in":["4.3-83.23.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"bash","fixed_in":["4.2-83.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"bash","fixed_in":["4.2-83.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"bash","fixed_in":["4.2-83.3.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","fixed_in":["4.3-7ubuntu1.8+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"bash","fixed_in":["4.3-14ubuntu1.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:OracleLinux:6","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:CentOS:6","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.2-48.el6.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-11+deb8u2"}]}],"versions":["4.3-11","4.3-11+deb8u1"],"bundled":2},{"source":"osv","ecosystem":"Mageia:6","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-48.4.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-32.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::computenode","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.7::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-34.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_aus:7.4::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_e4s:7.4::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_tus:7.4::server","package":"bash-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.46-30.el7_4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP3","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12 SP4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-83.23.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-83.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-83.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2-83.3.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.8+esm1"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4","4.3-7ubuntu1.5","4.3-7ubuntu1.6","4.3-7ubuntu1.7","4.3-7ubuntu1.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4"}]}],"versions":["4.3-14ubuntu1","4.3-14ubuntu1.1","4.3-14ubuntu1.2","4.3-14ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-14ubuntu1.4"}]}],"versions":["4.3-14ubuntu1","4.3-14ubuntu1.1","4.3-14ubuntu1.2","4.3-14ubuntu1.3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bash","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3-7ubuntu1.8+esm1"}]}],"versions":["4.2-5ubuntu3","4.3-1ubuntu2","4.3-2ubuntu1","4.3-3ubuntu1","4.3-4ubuntu1","4.3-4ubuntu2","4.3-6ubuntu1","4.3-7ubuntu1","4.3-7ubuntu1.1","4.3-7ubuntu1.2","4.3-7ubuntu1.3","4.3-7ubuntu1.4","4.3-7ubuntu1.5","4.3-7ubuntu1.6","4.3-7ubuntu1.7","4.3-7ubuntu1.8"]}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"gnu","product":"bash"},{"vendor":"netapp","product":"hci_management_node"},{"vendor":"netapp","product":"solidfire"},{"vendor":"opensuse","product":"leap"}],"references":[{"url":"https://bugs.launchpad.net/ubuntu/+source/bash/+bug/1803441","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://git.savannah.gnu.org/cgit/bash.git/tree/CHANGES?h=bash-4.4-testing#n65","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2019/03/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00049.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190411-0001/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4058-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://usn.ubuntu.com/4058-2/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9924","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-56xr-5j9v-w2wh"},{"url":"https://errata.tuxcare.com/els_os/oraclelinux6els/CLSA-2026-1777367927.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/centos6els/CLSA-2026-1777446568.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-9924","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0163.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=24751","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-04/msg00093.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1113","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.8_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691774","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1113.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9924","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9924","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3474","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3474.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3592","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3592.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3803","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3803.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190838-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1130324","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-9924","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190838-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190898-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-9924","tags":["report"]},{"url":"https://lists.gnu.org/archive/html/bug-bash/2017-03/msg00077.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4058-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4058-2","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-9924","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T07:05:28Z","modified":"2024-08-04T22:01:55.187Z","updated_at":"2026-11-02T14:20:20.081405Z"}],"euvd":[{"id":"EUVD-2019-19279","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T07:05:28Z","modified":"2024-08-04T22:01:55Z","updated_at":"2026-11-03T02:40:54.59684Z"}],"ghsa":[{"id":"GHSA-56xr-5j9v-w2wh","title":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus...","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2022-05-13T01:02:55Z","modified":"2023-02-01T05:02:35Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:49:56.778846Z"}],"nvd":[{"id":"CVE-2019-9924","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T08:29:00.467Z","modified":"2026-06-17T02:44:51.577Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:05:09.523883Z"}],"osv":[{"id":"CVE-2019-9924","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T08:29:00.467Z","modified":"2026-04-16T04:35:22.15031103Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:13.492058Z"},{"id":"DEBIAN-CVE-2019-9924","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T08:29:00.467Z","modified":"2026-09-21T07:00:13.472052685Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.57265Z"},{"id":"RHSA-2020:1113","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-16T02:51:10Z","modified":"2026-06-26T10:47:03Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:3474","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-16T02:51:34Z","modified":"2026-06-26T10:49:52Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3592","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-16T02:51:42Z","modified":"2026-06-26T10:49:58Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RHSA-2020:3803","title":"Red Hat Security Advisory: bash security update","status":"published","published":"2024-09-16T02:51:49Z","modified":"2026-06-26T12:22:08.833451469Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"UBUNTU-CVE-2019-9924","description":"rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.","status":"published","published":"2019-03-22T00:00:00Z","modified":"2026-02-04T04:34:51.639232Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.212782Z"},{"id":"CLSA-2026-1777367927","title":"bash: Fix of CVE-2019-9924","description":"- CVE-2019-9924: reject attempts to add pathnames containing slashes\n  to the hash table in restricted shell","status":"published","published":"2026-04-28T09:18:52Z","modified":"2026-06-01T00:33:25.864825623Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1777446568","title":"bash: Fix of CVE-2019-9924","description":"- CVE-2019-9924: reject attempts to add pathnames containing slashes\n  to the hash table in restricted shell","status":"published","published":"2026-04-29T07:09:33Z","modified":"2026-06-01T00:33:17.019909944Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"DLA-1726-1","title":"bash - security update","status":"published","published":"2019-03-25T00:00:00Z","modified":"2026-03-09T01:17:50.675269Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"MGASA-2019-0163","title":"Updated bash packages fix security vulnerability","description":"Updated bash package fixes security vulnerability:\n\nA vulnerability in which shell did not prevent user BASH_CMDS, allowing\nthe user to execute any command with the permissions of the shell\n(CVE-2019-9924).\n","status":"published","published":"2019-05-12T09:35:33Z","modified":"2026-04-16T04:43:30.30249443Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"SUSE-SU-2019:0838-1","title":"Security update for bash","description":"This update for bash fixes the following issues:\n\t  \nSecurity issue fixed: \n\n- CVE-2019-9924: Fixed a vulnerability in which shell did not prevent user BASH_CMDS \n  allowing the user to execute any command with the permissions of the shell (bsc#1130324).\n","status":"published","published":"2019-04-02T07:52:28Z","modified":"2026-02-04T02:23:03.891268Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0838-2","title":"Security update for bash","description":"This update for bash fixes the following issues:\n\t  \nSecurity issue fixed: \n\n- CVE-2019-9924: Fixed a vulnerability in which shell did not prevent user BASH_CMDS \n  allowing the user to execute any command with the permissions of the shell (bsc#1130324).\n","status":"published","published":"2019-07-05T17:46:48Z","modified":"2026-02-04T04:38:27.973492Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0898-1","title":"Security update for bash","description":"This update for bash fixes the following issues:\n\nSecurity issue fixed: \n\n- CVE-2019-9924: Fixed a vulnerability in which shell did not prevent user BASH_CMDS \n  allowing the user to execute any command with the permissions of the shell (bsc#1130324).\n","status":"published","published":"2019-04-08T09:09:04Z","modified":"2026-02-04T02:29:07.224989Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"USN-4058-1","title":"bash vulnerability","description":"It was discovered that Bash incorrectly handled the restricted shell. An\nattacker could possibly use this issue to escape restrictions and execute\nany command.\n","status":"published","published":"2019-07-15T14:31:15Z","modified":"2026-02-10T04:41:34Z","updated_at":"2026-11-02T16:58:14.019824Z"},{"id":"USN-4058-2","title":"bash vulnerability","description":"USN-4058-1 fixed a vulnerability in bash. This update provides\nthe corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n It was discovered that Bash incorrectly handled the restricted shell. An\n attacker could possibly use this issue to escape restrictions and execute\n any command.\n","status":"published","published":"2019-08-05T14:40:05Z","modified":"2026-02-10T04:41:34Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}