Riskcovery

CVE-2022-1292

The c_rehash script allows command injection

State
Published
Severity
9.8 Critical
Published
May 3, 2022
Updated
Oct 14, 2026
Reserved
Apr 11, 2022

Read the record on cve.org

Description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Scores

CVSSScoreVectorSource
3.19.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCISA-ADP

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
OpenSSLOpenSSL
  • Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)Affected
  • Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n)Affected
  • Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.