CVE-2014-6271 -- please upgrade bash asap if you're using it

[Sitaram Chamarty]

Hi all,

Several URLs exist, here's one: https://access.redhat.com/security/cve/CVE-2014-6271

To test:

env x='() { :;}; echo vulnerable' bash -c "echo this is a test"

Affects gitolite. Happens before gitolite-shell gets control, so it's
not even *logged* by gitolite!

Upgrade bash asap and re-test as above. Or change the shell for the
gitolite hosting user to dash or zsh.

Note: some places suggest "ln -sf /bin/<some other shell> /bin/sh".
That won't work. Sshd uses the hosting user's shell, and if that is
explicitly named as "/bin/bash", it'll run bash.