SECURING INTERNET-CRITICAL SOFTWARE: HOW WE COULD HAVE BACKDOORED BASH

Summary from the TLDR InfoSec newsletter

GNU Savannah's Savane forge passed a user's email address unescaped into a shell command during GPG key testing, so an RFC-valid address containing backtick-wrapped commands gave any registered user code execution on the backend. Hacktron researchers used that foothold to read database credentials, grant themselves superuser, and impersonate Bash maintainer Chet Ramey, which exposed an SSH key page that would have allowed pushes to upstream Bash, before an unpatched GameOver(lay) kernel bug gave them root and a key to a GNU backup server. The FSF fixed all 26 reported flaws, and forge operators should pass process arguments as arrays rather than shell strings, treat email local parts as untrusted input, and verify that LTS kernels actually receive backported fixes.