By evening Debian Testing had a patch:
Now I seem to be safe:
However, the real issue here does not seem to be Linux desktops:
...this bash bug has been around for a long, long time. That means there are lots of old devices on the network vulnerable to this bug. The number of systems needing to be patched, but which won't be is [large].Robert Graham, on tomsguide.com.