A family of arbitrary code execution vulnerabilities in Bash that had existed since 1989, affecting every Unix/Linux system. Within hours of disclosure, botnets formed and millions of attacks were recorded. FFIEC issued emergency alerts to all US financial institutions. Bash had been maintained by Chet Ramey essentially alone for 25 years.
VULN_RECENT_FREQUENCY + maintainer health preconditions
| Tool | Verdict | Details |
|---|---|---|
| OSS Risk Guard | Caught | VULN_RECENT_FREQUENCY + maintainer health preconditions |
| Socket | After damage | Detects after CVE published |
| Snyk | After damage | CVE detection after publication; reactive not proactive |
| Sonatype (Nexus) | After damage | Detects after CVE published |
| Black Duck | After damage | Detects after CVE published |
| Endor Labs | After damage | CVE detection + reachability analysis after publication; reactive |