OpenSSL Security Update - Command Injection and Encryption Failure
Summary
ALSA-2022:5818: Moderate: openssl security update. Affects openssl versions < 1:1.1.1k-7.el8_6. Fixed in 1:1.1.1k-7.el8_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely used toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols. It also serves as a general-purpose cryptography library. The toolkit provides encryption, decryption, and other cryptographic functions to secure network communications and protect sensitive data. However, certain versions of OpenSSL are vulnerable to command injection and encryption failure.
Vulnerability Detail
The first vulnerability (CVE-2022-1292) is related to the c_rehash script in OpenSSL, which allows command injection. An attacker can exploit this vulnerability to execute arbitrary commands with the privileges of the user running the script. The second vulnerability (CVE-2022-2068) is also related to the c_rehash script and allows command injection. The third vulnerability (CVE-2022-2097) affects the AES OCB encryption algorithm in OpenSSL, causing it to fail in encrypting certain bytes. This vulnerability could potentially lead to data leakage or manipulation.
How To Fix
Minimum fixed version
1:1.1.1k-7.el8_6
This is the first release that contains the fix.
sudo dnf update opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. Updating to the fixed version is the recommended solution.
Conclusion
OpenSSL is a critical component for securing network communications, and it is important to promptly address these vulnerabilities by updating to the fixed version. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for openssl →
FAQ
OpenSSL is a toolkit that implements SSL and TLS protocols and provides cryptographic functions for securing network communications.
Command injection is a vulnerability that allows an attacker to execute arbitrary commands on a system by injecting malicious input into a command execution context.
AES OCB (Authenticated Encryption with Associated Data - Offset Codebook) is a mode of operation for the AES encryption algorithm that provides both confidentiality and integrity of the encrypted data.
The command injection vulnerabilities can allow an attacker to execute arbitrary commands with the privileges of the user running the affected script. The encryption failure vulnerability can lead to data leakage or manipulation.
To update OpenSSL, you can use the package manager or distribution-specific update mechanism to install the latest version provided by the vendor.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
