I could attach all the patch Backports to this Bug but since I am neither the BASH maintainer nor have I ever turned in a CVE request, please let this serve as the template bug for whatever needs to be done to patch this in the interim.
See also: https://securityblog.redhat.com/2014/09/24/bash-specially-crafted-environment-variables-code-injection-attack/
Duplicates bug 523592
*** This bug has been marked as a duplicate of bug 523592 ***