squeeze. jessie and wheezy are still vulnerable.
It's been uploaded to squeeze-lts but has not reached the mirrors.
You can get it manually from http://incoming.debian.org/debian-buildd/pool/main/b/bash/ if you can't wait.
deb http://http.debian.net/debian/ squeeze-lts main contrib non-free
deb-src http://http.debian.net/debian/ squeeze-lts main contrib non-free env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable
this is a test
apt-get update
apt-get install bash
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
Edited: Seems like jvreeland has a clearer picture: https://news.ycombinator.com/item?id=8362309
ii bash 4.3-9 i386 GNU Bourne Again SHell
$ env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
vulnerable this is a test
From the FAQ:
> Does sid have security updates?
Not in the same sense that stable does. If the maintainer of a package fixes a security bug and uploads the package, it'll go into sid by the normal means. If the maintainer doesn't do that, then it won't. The security team only covers stable (and possibly testing... there's a pending issue for that case).