PT-2022-2691 · Openssl+12 · Openssl+12
Elison Niven
·
Published
2022-04-02
·
Updated
2026-04-27
·
CVE-2022-1292
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
OpenSSL versions 1.0.2 through 1.0.2zd
OpenSSL versions 1.1.1 through 1.1.1n
OpenSSL versions 3.0.0 through 3.0.2
Description
The c rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool.
Recommendations
For OpenSSL versions 1.0.2 through 1.0.2zd, update to version 1.0.2ze.
For OpenSSL versions 1.1.1 through 1.1.1n, update to version 1.1.1o.
For OpenSSL versions 3.0.0 through 3.0.2, update to version 3.0.3.
As a temporary workaround, consider disabling the c rehash script until a patch is available.
Restrict access to the vulnerable script to minimize the risk of exploitation.
Exploit
Fix
DoS
Command Injection
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Almalinux
Astra Linux
Centos
Ibm Aix
Linuxmint
Mysql Server
Openssl
Red Hat
Red Os
Rocky Linux
Suse
Ubuntu