CVE-2022-2068High· 7.3▾ TwilightIn addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 19.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
95%
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
openssl >= 1.0.2, < 1.0.2zfopenssl >= 1.1.1, < 1.1.1popenssl >= 3.0.0, < 3.0.4debian_linux = 10.0debian_linux = 11.0fedora = 35fedora = 36sinec_ins < 1.0sinec_ins = 1.0element_softwarehci_management_nodeontap_antivirus_connectorontap_select_deploy_administration_utilitysantricity_smi-s_providersmi-s_providersnapmanagersolidfirebootstrap_osh615c_firmwareh610s_firmwareh610c_firmwareh410c_firmwareh300s_firmwareh500s_firmwareh700s_firmwareh410s_firmwarefas_8300_firmwarefas_8700_firmwarefas_a400_firmwareaff_8300_firmwareaff_8700_firmwareaff_a400_firmwaresannavUpgrade past the affected range:
openssl 3.0.4sinec_ins 1.0Connected by shared product, vendor, weakness, or advisory.
CVE-2022-2274Critical· 9.8The OpenSSL 3.0.4 release introduced a serious bug in the RSA implementation for X86_64 CPUs supporting the AVX512IFMA instructions
CVE-2022-2097Medium· 5.3AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances
CVE-2022-1292High· 7.3The c_rehash script does not properly sanitise shell metacharacters to prevent command injection
CVE-2022-4304Medium· 5.9A timing based side channel exists in the OpenSSL RSA Decryption implementation which could be sufficient to recover a plaintext across a network in a Bleichenbacher style attack
CVE-2022-4450High· 7.5The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and decodes the "name" (e.g
CVE-2022-1473High· 7.5The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries