September 25, 2014
Originally published on the CoreOS blog (archived copy) .
As many of you have heard, there are open Bash vulnerabilities, CVE-2014-6271, and CVE-2014-7169. The common vectors for arbitrary code execution from these CVEs include: bash exposed via certain web applications and dhcpcd scripts. Additionally, SSH accounts restricted by the command= option in their ssh key can bypass that restriction.
By default, CoreOS is not configured in a way that would allow these issues to be exploited. Regardless, we are working to further protect our users by incorporating the fixes, once released and verified, into a new build. We were prepared to roll out a new release yesterday (September 24th, 2014), but the original fix for the CVEs proved to be insufficient by the developers.
If you are running containers on top of CoreOS that utilize a vulnerable bash and that bash is exposed to the open internet via a mechanism like CGI, then you will need to update your containers accordingly.
All CoreOS channels including, Stable, Beta, and Alpha ship with bash 4.2.20 which is affected by CVE-2014-6271 and CVE-2014-7169.
$ bash --version
GNU bash, version 4.2.20(1)-release (x86_64-cros-linux-gnu)
Copyright (C) 2011 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
CoreOS is actively tracking the open CVEs and is prepared to release 410.1.0 (Stable), 440.2.0 (Beta), and an Alpha release once CVE-2014-6371 and CVE-2014-7169 have been patched upstream and verified by the CoreOS team.
AcceptEnv in sshd.conf and ssh keys restricted by a command option in authorized_keys.