cbcvebase.
CVE-2022-2068
published 2022-06-21

CVE-2022-2068: In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise…

PriorityP261high7.3CVSS 3.1
AVLACLPRLUIRSUCHIHAH
EPSS
96.28%
99.9th percentile
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Affected

20 ranges
VendorProductVersion rangeFixed in
debiandebian_linux
debiandebian_linux
debianopenssl< openssl 3.0.4-1 (bookworm)openssl 3.0.4-1 (bookworm)
fedoraprojectfedora
fedoraprojectfedora
msrccbl2_openssl_1.1.1k-17_on_cbl_mariner_2.0
msrccm1_openssl_1.1.1k-12_on_cbl_mariner_1.0
nodejsnodejs>= 0 < 12.22.9~dfsg-1ubuntu3.112.22.9~dfsg-1ubuntu3.1
opensslopenssl>= 0 < 1.1.1n-0+deb11u31.1.1n-0+deb11u3
opensslopenssl>= 0 < 3.0.4-13.0.4-1
opensslopenssl>= 0 < 3.0.4-13.0.4-1
opensslopenssl>= 0 < 3.0.4-13.0.4-1
opensslopenssl>= 0 < 1.0.1f-1ubuntu2.27+esm101.0.1f-1ubuntu2.27+esm10
opensslopenssl>= 1.0.2 < 1.0.2zf1.0.2zf
opensslopenssl>= 1.1.1 < 1.1.1p1.1.1p
opensslopenssl>= 3.0.0 < 3.0.43.0.4
paloaltocortex_xdr
paloaltopan-os
siemenssinec_ins< 1.01.0
siemenssinec_ins

Detection & IOCsextracted from sources · hover to see the quote

  • The vulnerability is triggered when file names of certificates being hashed are passed unsanitized to a shell command within the c_rehash script — monitor for unexpected shell metacharacter usage or child process spawning from c_rehash execution
  • On systems where c_rehash is automatically executed, an attacker can trigger arbitrary OS command execution by placing a specially crafted certificate file name containing shell metacharacters in the certificate directory
  • Monitor for unexpected process execution spawned by the c_rehash script (e.g., bash/sh child processes with unusual arguments), especially on systems where c_rehash runs automatically
  • For ICS/OT environments, Mitsubishi Electric GT SoftGOT2000 versions 1.275M through 1.280S are affected; monitor for exploitation via specially crafted certificates sent to these devices
  • On Red Hat systems, check for presence of the c_rehash script in the openssl-perl package (Optional repository); the script is not installed by default but its presence indicates exposure
  • ·The c_rehash script does not properly sanitise shell metacharacters in certificate file names; the incomplete fix for CVE-2022-1292 left additional injection points unaddressed
  • ·Red Hat systems using update-ca-trust with a single bundled certificate store are not automatically vulnerable since c_rehash is not included in default RHEL installations and is never executed automatically
  • ·Red Hat Satellite embeds an affected c_rehash script in puppet-agent but is not considered vulnerable because it does not execute the script with untrusted data and the scriptlet is root-owned
  • ·Affected OpenSSL versions span three branches: 3.0.0–3.0.3 (fixed in 3.0.4), 1.1.1–1.1.1o (fixed in 1.1.1p), and 1.0.2–1.0.2ze (fixed in 1.0.2zf)

CVSS provenance

nvdv3.17.3HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
osv7.5HIGH
vendor_msrc9.8CRITICAL
vendor_oracle9.8HIGH
vendor_ubuntu7.5HIGH
vendor_debian7.3HIGH
vendor_redhat7.3HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.