Not rated
CVE-2022-1292 The c_rehash script allows command injection
Description
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| OpenSSL | Versions not published | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 | earliest → < 1.1 | 1.1 |
| SINAMICS PERFECT HARMONY GH180 | Versions not published | |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
References
- www.openssl.org www.openssl.org
- git.openssl.org git.openssl.org
- git.openssl.org git.openssl.org
- git.openssl.org git.openssl.org
- [debian-lts-announce] 20220515 [SECURITY] [DLA 3008-1] openssl security update lists.debian.org
- DSA-5139 www.debian.org
- FEDORA-2022-b651cb69e6 lists.fedoraproject.org
- FEDORA-2022-c9c02865f6 lists.fedoraproject.org
- www.oracle.com www.oracle.com
- security.netapp.com security.netapp.com
- psirt.global.sonicwall.com psirt.global.sonicwall.com
- security.netapp.com security.netapp.com
- GLSA-202210-02 security.gentoo.org
- cert-portal.siemens.com cert-portal.siemens.com
Timeline
- Published
- Last modified
Other CVEs of OpenSSL
The 141 CVEs of OpenSSL →
CVE-2026-84784
Issue summary: A malicious remote peer may flood the local QUIC stack with NEW_CONNECTION_ID frames by avoiding a…
Not rated
CVE-2026-84783
Issue summary: The first concurrent use of the same X.509 certificate by several threads may cause its cached…
Not rated
CVE-2026-84782
Issue summary: The DTLS retransmission logic does not correctly handle a handshake message write that is suspended…
Not rated
CVE-2026-77696
Issue summary: SM2 signature generation uses non-constant-time arithmetic on secret values, forming a timing…
Not rated