CVE-2022-2068: The c_rehash script allows command injection
A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it is automatically executed. On these operating systems, this flaw allows an attacker to execute arbitrary commands with the privileges of the script.
Other sources
In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the crehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
The crehash script allows command injection
— Microsoft
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2022-2068.
What is the severity of CVE-2022-2068?
The severity of CVE-2022-2068 is critical with a severity value of 9.8.
What is the affected software?
The affected software includes OpenSSL versions 1.0.2 to 1.0.2zf, 1.1.1 to 1.1.1p, and 3.0.0 to 3.0.4, as well as certain packages from Red Hat, Debian, and other sources.
How can a remote attacker exploit CVE-2022-2068?
A remote attacker can exploit CVE-2022-2068 by injecting arbitrary commands into the c_rehash script, leading to command injection and potential execution of arbitrary commands on the system.
Are there any remediation steps available?
Yes, there are remediation steps available. Please refer to the provided references for detailed instructions and patches.