If you absolutely must run an EL4 workload, please do not do it on CentOS-4 and instead pay for and upgrade to RHEL-4 ELS as described in the above link from February 2012. CentOS-4 is unsafe .. don't use it .. don't do it .. please.
Or, use the source, Luke. There are official patches for 3.x and 4.x.
The patched code is so old that even 4.2 patch 48 applies cleanly(*) to bash-2.05b, which is RHEL3 territory.
* minus the patchlevel.h bit