Home / Companies / Twilio / Blog / Post Details
Content Deep Dive

Security Update for CVE-2014-6271 (Shellshock)

Blog post from Twilio

Post Details
Company
Date Published
Author
Twilio
Word Count
351
Language
English
Hacker News Points
-
Summary

The Twilio security team discovered a code-injection vulnerability in bash dubbed "Shellshock" and nicknamed CVE-2014-6271. `Twilio immediately upgraded its affected bash versions across its infrastructure to prevent potential exposure, although it's uncertain if its own infrastructure was directly exposed. `The company is urging customers to upgrade their bash installs to mitigate the risk of this vulnerability, which can be exploited by remote attackers to execute arbitrary code via a crafted environment variable. `Customers deploying services without authentication are advised to take immediate action to secure their systems. `Further information and resources on the vulnerability, including testing methods and mitigation steps, are available online.