Re: CVE-2014-6271: remote code execution through bash

[Solar Designer <solar () openwall com>]

On Thu, Sep 25, 2014 at 01:34:51PM -0400, Christos Zoulas wrote:
> I think that at this point the only salvation is to disable function
> import by default and provide a command line flag and a "set" flag
> to explicitly enable it (so that scripts that depend on it can
> easily be fixed). It is not a widely used feature, and both subshells
> and sourced scripts don't need it or use it. It might have seemed
> like a good idea a couple of decades ago, but it needs to go.

Good idea to also add a "set" flag.  Thanks!

Alexander