What's wrong in bash?

/bin and /sbin has to be removed from the PATH
there is nothing in this folders

so /usr/bin and /usr/sbin are the path's to go

The DEFAULT_PATH_VALUE in bash (/usr/local/bin:/bin:/usr/bin) is used only if the PATH env variable is not set.
There weren't any complains about the value, but after UsrMove I can understand that /bin is wrong, so I will just remove /bin.

bash-4.2.29-2.fc17 has been submitted as an update for Fedora 17.
https://admin.fedoraproject.org/updates/bash-4.2.29-2.fc17

i do not see this changed
(yes this is a new ssh session after update)

from where comes "/sbin:/bin" in $PATH below?

______________

[root@srv-rhsoft:~]$ rpm -q bash
bash-4.2.29-2.fc17.x86_64

[root@srv-rhsoft:~]$ echo $PATH
/usr/lib64/qt-3.3/bin:/usr/NX/bin:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin:/root/bin:/scripts

[root@srv-rhsoft:~]$ cat ~/.bash* | grep /bin/
stat /usr/bin/ffmpeg 
yum provides /usr/bin/cur
yum search /bin/cur
yum install /bin/cur
yum install /usr/bin/cur
yum provides /bin/bash
yum provides /bin/cur
cat /usr/local/bin/dbmail-cleanup
cat  bashrc | grep /bin/
cat profile.d/* | grep /bin/

[root@srv-rhsoft:~]$ cat /etc/profile | grep /bin/
if [ -x /usr/bin/id ]; then
HOSTNAME=`/bin/hostname 2>/dev/null`

[root@srv-rhsoft:~]$ cat /etc/bashrc | grep /bin/

But your report is about hardcoded PATH value. The hardcoded PATH value in bash is used if and only if PATH env variable is unset.

Package bash-4.2.29-2.fc17:
* should fix your issue,
* was pushed to the Fedora 17 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing bash-4.2.29-2.fc17'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2012-9833/bash-4.2.29-2.fc17
then log in and leave karma (feedback).

bash-4.2.29-2.fc17 has been pushed to the Fedora 17 stable repository.  If problems still persist, please make note of it in this bug report.