CVE-2022-1292 — OS Command Injection in Openssl
Severity
7.3HIGHNVD
EPSS
39.0%
top 2.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 3
Latest updateOct 10
Description
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Af…
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HExploitability: 1.3 | Impact: 5.9
Affected Packages8 packages
Also affects: Debian Linux 10.0, 11.0, 9.0, Fedora 35, 36
🔴Vulnerability Details
6GHSA▶
GHSA-qjmp-vmxc-7p8r: The c_rehash script does not properly sanitise shell metacharacters to prevent command injection↗2022-05-04