WeBWorK Main Forum

Shellshock

Shellshock

by Alex Jordan -
Number of replies: 3
Does anyone have any reason to think that updating bash (in order to protect against shellshock) on a production server could negatively affect WeBWorK somehow?
In reply to Alex Jordan

Re: Shellshock

by Paul Pearson -
Hi Alex,

The article

http://www.vox.com/2014/9/25/6843949/the-bash-bug-explained

explains the shellshock bug pretty plainly.  It seems the shellshock bug allows commands to be passed when environment variables are set in bash.

Personally, I know neither how much WeBWorK uses bash to set environment variables, nor how the shellshock bug is fixed.  My guess is that the WeBWorK code never passes a command when environment variables are set in bash, and that the shellshock bug fix will not cause any problems.  But, that is just a guess based on speculation, not examining the code (so it may be incorrect).  I hope this helps.

Best regards,

Paul Pearson
In reply to Alex Jordan

Re: Shellshock

by George Jennings -
We updated our ubuntu 14.04 server with no ill effects that we can see. Webwork seems to be running fine.
In reply to George Jennings

Re: Shellshock

by Alan Ableson -
And if two stories will eventually turn into data :), we performed the same Ubuntu 14.04 security update, and Webwork seems to be working normally for us as well.