rbash in Bash before 4.4-beta2 did not prevent the shell user from modifying BASH_CMDS, thus allowing the user to execute any command with the permissions of the shell.
{ "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "ubuntu_priority": "low", "binaries": [ { "bash-dbgsym": "4.3-7ubuntu1.8+esm1", "bash-builtins": "4.3-7ubuntu1.8+esm1", "bash": "4.3-7ubuntu1.8+esm1", "bash-static-dbgsym": "4.3-7ubuntu1.8+esm1", "bash-doc": "4.3-7ubuntu1.8+esm1", "bash-static": "4.3-7ubuntu1.8+esm1" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "bash-dbgsym": "4.3-14ubuntu1.4", "bash-builtins": "4.3-14ubuntu1.4", "bash": "4.3-14ubuntu1.4", "bash-static-dbgsym": "4.3-14ubuntu1.4", "bash-doc": "4.3-14ubuntu1.4", "bash-static": "4.3-14ubuntu1.4" } ] }
{ "availability": "No subscription required", "ubuntu_priority": "low", "binaries": [ { "bash-builtins": "4.4.18-2ubuntu1", "bash": "4.4.18-2ubuntu1", "bash-static-dbgsym": "4.4.18-2ubuntu1", "bash-dbgsym": "4.4.18-2ubuntu1", "bash-doc": "4.4.18-2ubuntu1", "bash-builtins-dbgsym": "4.4.18-2ubuntu1", "bash-static": "4.4.18-2ubuntu1" } ] }