We are not out of the woods yet
Red Hat has become aware that the patch for CVE-2014-6271 is incomplete.
"Update: 2014-09-25 03:10 UTC
Red Hat has become aware that the patch for CVE-2014-6271 is incomplete. An attacker can provide specially-crafted environment variables containing arbitrary commands that will be executed on vulnerable systems under certain conditions. The new issue has been assigned CVE-2014-7169. Red Hat is working on patches in conjunction with the upstream developers as a critical priority. For details on a workaround, please see the FAQ below."
Biting the hand that feeds IT
