platform

we have built and released to the amahi 7 repos an update to hda-ctl (hda-ctl-5.4.1) that contains a dependency on bash-4.2.47-2

Never mind, guess third time is a charm. I did the yum clean metadata all 3 times and finally on the last attempt it picked up the new bash.

Sorry for the false alarm.

there are lots of caching and distribution latency with mirrors on the upstream distribution, so what is surprising is that three times worked right away, maybe it picked up some other mirrors that had the updated packages.

Anyone wanting to know if it's fixed (at least on the current best levels), you can type this in the command line

env x='() { :;}; echo vulnerable' bash -c 'echo done'
<pre>

a fixed bash will look something like this:
</pre>
$ env x='() { :;}; echo vulnerable' bash -c 'echo done'
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
done

and a bad bash will echo the word "vulnerable".

There was another update to bash (and it may not be the last one).

We just pushed an update of hda-ctl to the repos requiring bash >= 4.2.48-2.