CVE-2022-2068criticalCWE-78

CVE-2022-2068: falha crítica em OpenSSL

The c_rehash script allows command injection

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar OpenSSL+ Monitorar openssl

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

50Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 9.8epss 96%
O que os fabricantes declaram (VEX)

Declarações oficiais dos fabricantes em formato CSAF/VEX: se o produto deles está afetado, já corrigido ou descartado — e por quê. É afirmação do fabricante, não juízo do Vexday.

Red Hatdocumento VEX ↗
Afetado
8 produtos (27 componentes)
Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9 · Red Hat Virtualization 4 · e outros 3
workaround: As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.
Corrigido
19 produtos (144 componentes)
Red Hat Enterprise Linux BaseOS (v. 8) · Red Hat Enterprise Linux BaseOS (v. 9) · Red Hat Enterprise Linux AppStream (v. 9) · Red Hat JBoss Core Services on RHEL 8 · Satellite Client 6 for RHEL 7 · e outros 14
correção ↗
Não afetado
12 produtos (2.328 componentes) — porque o código vulnerável não está presente no produto
Red Hat Satellite 6.14 for RHEL 8 · Red Hat JBoss Core Services on RHEL 8 · Red Hat Satellite 6.13 for RHEL 8 · Red Hat JBoss Core Services on RHEL 7 Server · Satellite Client 6 for RHEL 8 · e outros 7
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Produtos afetados
OpenSSL · OpenSSL
CVEs relacionadas — OpenSSL

No mesmo produto, das mais perigosas para as menos.

CVE-2022-3786HIGHX.509 Email Address Variable Length Buffer OverflowEPSS 92.5%CVE-2022-3602HIGHX.509 Email Address 4-byte Buffer OverflowEPSS 90.8%CVE-2021-3711—SM2 Decryption Buffer OverflowEPSS 87.8%CVE-2022-1292CRITICALThe c_rehash script allows command injectionEPSS 82.6%CVE-2023-2650MEDIUMPossible DoS translating ASN.1 object identifiersEPSS 75.4%CVE-2025-15467HIGHStack buffer overflow in CMS (Auth)EnvelopedData parsingEPSS 74.8%