CVE-2022-2068 The c_rehash script allows command injection
Description
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| OpenSSL | Versions non publiées | |
| SIMATIC S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
| SIMATIC S7-1500 TM MFP - GNU/Linux subsystem 1.1 | premières → < 1.1 | 1.1 |
| SIPLUS S7-1500 CPU 1518-4 PN/DP MFP 3.1 | 3.1.0 → < 3.1.5 | 3.1.5 |
Références
- www.openssl.org www.openssl.org
- git.openssl.org git.openssl.org
- git.openssl.org git.openssl.org
- git.openssl.org git.openssl.org
- DSA-5169 www.debian.org
- FEDORA-2022-3b7d0abd0b lists.fedoraproject.org
- security.netapp.com security.netapp.com
- FEDORA-2022-41890e9e44 lists.fedoraproject.org
- cert-portal.siemens.com cert-portal.siemens.com
Chronologie
- Publiée
- Dernière modification