CVE-2022-1292
03.05.2022, 16:15
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
| Vendor | Product | Version |
|---|---|---|
| openssl | openssl | 1.0.2 ≤ 𝑥 < 1.0.2ze |
| openssl | openssl | 1.1.1 ≤ 𝑥 < 1.1.1o |
| openssl | openssl | 3.0.0 ≤ 𝑥 < 3.0.3 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| debian | debian_linux | 11.0 |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | active_iq_unified_manager | - |
| netapp | clustered_data_ontap | - |
| netapp | clustered_data_ontap_antivirus_connector | - |
| netapp | oncommand_insight | - |
| netapp | oncommand_workflow_automation | - |
| netapp | santricity_smi-s_provider | - |
| netapp | smi-s_provider | - |
| netapp | snapcenter | - |
| netapp | snapmanager | - |
| netapp | solidfire\,_enterprise_sds_\&_hci_storage_node | - |
| netapp | solidfire_\&_hci_management_node | - |
| netapp | a700s_firmware | - |
| netapp | h300s_firmware | - |
| netapp | h500s_firmware | - |
| netapp | h700s_firmware | - |
| netapp | h300e_firmware | - |
| netapp | h500e_firmware | - |
| netapp | h700e_firmware | - |
| netapp | h410s_firmware | - |
| netapp | aff_8300_firmware | - |
| netapp | fas_8300_firmware | - |
| netapp | aff_8700_firmware | - |
| netapp | fas_8700_firmware | - |
| netapp | aff_a400_firmware | - |
| netapp | fabric-attached_storage_a400_firmware | - |
| netapp | a250_firmware | - |
| netapp | aff_500f_firmware | - |
| netapp | fas_500f_firmware | - |
| oracle | enterprise_manager_ops_center | 12.4.0.0 |
| oracle | mysql_server | 5.0.0 ≤ 𝑥 ≤ 5.7.38 |
| oracle | mysql_server | 8.0.0 ≤ 𝑥 ≤ 8.0.29 |
| oracle | mysql_workbench | 𝑥 ≤ 8.0.29 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| edk2 |
| ||||||||||||||||||||
| nodejs |
| ||||||||||||||||||||
| openssl |
| ||||||||||||||||||||
| openssl1.0 |
|
References