CVE-2022-1292
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 82.6%, higher than 100% of all known CVEs. Patch or mitigate before the next change window.
Description
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
- CVSS 3.1
- 7.3 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 82.61% probability · 100th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-78
- Affected
- siemens/brownfield connectivity gateway · openssl/openssl · debian/debian linux · netapp/active iq unified manager · netapp/clustered data ontap · netapp/clustered data ontap antivirus connector · netapp/oncommand insight · netapp/oncommand workflow automation · netapp/santricity smi-s provider · netapp/smi-s provider · netapp/snapcenter · netapp/snapmanager · netapp/solidfire\, enterprise sds \& hci storage node · netapp/solidfire \& hci management node · netapp/a700s firmware · netapp/h300s firmware · netapp/h500s firmware · netapp/h700s firmware · netapp/h300e firmware · netapp/h500e firmware · +15 more
- Source
- openssl-security@openssl.org
EPSS 82.6% since 3 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdfThird Party Advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2Broken Link
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfebBroken Link
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23Broken Link
- https://lists.debian.org/debian-lts-announce/2022/05/msg00019.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/Mailing List, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011Third Party Advisory
- https://security.gentoo.org/glsa/202210-02Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220602-0009/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5139Third Party Advisory
- https://www.openssl.org/news/secadv/20220503.txtVendor Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdfThird Party Advisory
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2Broken Link
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfebBroken Link
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23Broken Link
- https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis
- https://lists.debian.org/debian-lts-announce/2022/05/msg00019.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/Mailing List, Third Party Advisory
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011Third Party Advisory
- https://security.gentoo.org/glsa/202210-02Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220602-0009/Third Party Advisory
- https://security.netapp.com/advisory/ntap-20220729-0004/Third Party Advisory
- https://www.debian.org/security/2022/dsa-5139Third Party Advisory
- https://www.openssl.org/news/secadv/20220503.txtVendor Advisory
- https://www.oracle.com/security-alerts/cpujul2022.htmlThird Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-146325.html
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.