<html><body><div style="font-family: times new roman, new york, times, serif; font-size: 12pt; color: #000000"><blockquote style="border-left:2px solid #1010FF;margin-left:5px;padding-left:5px;color:#000;font-weight:normal;font-style:normal;text-decoration:none;font-family:Helvetica,Arial,sans-serif;font-size:12pt;"><div dir="ltr"><div><div style="font-family:times new roman,new york,times,serif;font-size:12pt;color:rgb(0,0,0)"><div>The expected security improvement is essentially nonexistent. In the current case of importing functions from the environment (and we could have a looong philosophical conversation about whether this is a vulnerability in bash or in its callers, where the likely outcome is “not a vulnerability in bash but by far easiest to fix in bash”)<br></div></div></div><div><div class="gmail_extra"><div class="gmail_quote"><div><br></div><div>Why would this be a philosophical discussion when there were clearly bugs in the parser allowing things it shouldn't even if you consider the use cases valid otherwise?</div></div></div></div></div></blockquote><div>As I said in the snipped part, anyone able to submit arbitrary input to a shell can already cause it to do arbitrary things. The parser bugs do not give the attacker anything they don’t already have, so they are not security-relevant. So we are back to the philosophical discussion about where is the vulnerability in putting untrusted data into the environment.<br></div><div> Mirek<br></div></div></body></html>