On 9/30/25 00:23, Solar Designer wrote:
[...] So is the vulnerability in the shell, like Shellshock was determined to be? [...] the shell maintainers may well dispute this CVE on such grounds as well as because the shell worked exactly as documented. [...]
Small nit here: Shellshock was clearly a vulnerability in Bash and I am unsure if the way Bash exports shell functions was documented at all.
If presented with an environment variable value having the correct form for a shell function, but containing more text than the body of the function, Bash would immediately execute the trailing text as commands while importing the shell function from the environment. That was Shellshock.
This went unnoticed for years because Bash, of course, would never include trailing text when *exporting* a shell function, so the vulnerable code path went unexercised. I have used Shellshock as a counterexample to claims that input validation is unneeded because the data will always be written correctly in the proper format by the same program.
-- Jacob
