Log in Start free

Vulnerability · Published Jun 21, 2022 · Assigned by openssl

CVE-2022-2068The c_rehash script allows command injection

Critical 9.8

In plain English

A critical-severity OS command injection in OpenSSL from OpenSSL. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 96.4% (higher than 99.9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)96.4%top 0.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openssl1:1.1.1k-7.el8_6ALSA-2022:5818
AlmaLinux:9openssl1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:8openssl-devel1:1.1.1k-7.el8_6ALSA-2022:5818
AlmaLinux:9openssl-devel1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:8openssl-libs1:1.1.1k-7.el8_6ALSA-2022:5818
AlmaLinux:9openssl-libs1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:8openssl-perl1:1.1.1k-7.el8_6ALSA-2022:5818
AlmaLinux:9openssl-perl1:3.0.1-41.el9_0ALSA-2022:6224
Alpine:v3.20openssl0ALPINE-CVE-2022-2068
Alpine:v3.21openssl0ALPINE-CVE-2022-2068
Alpine:v3.22openssl0ALPINE-CVE-2022-2068
Alpine:v3.23openssl0ALPINE-CVE-2022-2068
Alpine:v3.24openssl0ALPINE-CVE-2022-2068
Debian:12openssl3.0.4-1DEBIAN-CVE-2022-2068
Debian:13openssl3.0.4-1DEBIAN-CVE-2022-2068
Debian:14openssl3.0.4-1DEBIAN-CVE-2022-2068
Rocky Linux:8openssl1:1.1.1k-7.el8_6RLSA-2022:5818
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.1USN-6457-1
Ubuntu:22.04:LTSnodejs12.22.9~dfsg-1ubuntu3.1UBUNTU-CVE-2022-2068
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.5UBUNTU-CVE-2022-2068
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.5USN-5488-1

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3)Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o)Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References