Command Injection Vulnerability in OpenSSL's c_rehash Script
Summary
ALPINE-CVE-2022-1292: The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. Affects openssl versions < 0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used software library that provides robust encryption and security protocols for data transmission over networks. It is essential for securing communications on the internet. The c_rehash script is a utility that helps manage certificate directories by creating symbolic links to certificate files. However, this script has been found to be vulnerable to command injection, which can lead to severe security risks if exploited.
Vulnerability Detail
The vulnerability stems from the c_rehash script's failure to properly sanitize shell metacharacters, allowing an attacker to execute arbitrary commands with the privileges of the script. This issue is particularly concerning as the script may be executed automatically by certain operating systems, potentially leading to unauthorized access and control over the system. The vulnerability affects multiple versions of OpenSSL, specifically 3.0.0 to 3.0.2, 1.1.1 to 1.1.1n, and 1.0.2 to 1.0.2zd, with a CVSS score of 7.3 indicating a high severity level.
How To Fix
To rectify the vulnerability, it is crucial to update OpenSSL to a patched version. Users should upgrade to OpenSSL 3.0.3 or later, 1.1.1o or later, or 1.0.2ze or later. The following command can be used to update OpenSSL on Alpine Linux
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the c_rehash script and instead utilize the OpenSSL rehash command line tool, which does not have this vulnerability.
Conclusion
The command injection vulnerability in OpenSSL's c_rehash script poses significant security risks due to its potential for exploitation. Users are strongly advised to update to the latest patched versions of OpenSSL to mitigate these risks. For those unable to update immediately, utilizing alternative tools and monitoring solutions like Vulert can help manage exposure to this vulnerability.
See every vulnerability recorded for openssl →
FAQ
The c_rehash script is a utility provided by OpenSSL to manage certificate directories by creating symbolic links to certificate files.
An attacker can exploit this vulnerability by injecting malicious commands into the c_rehash script, potentially gaining unauthorized access to the system.
The affected versions include OpenSSL 3.0.0 to 3.0.2, 1.1.1 to 1.1.1n, and 1.0.2 to 1.0.2zd.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground.
If an immediate update is not possible, avoid using the c_rehash script and switch to the OpenSSL rehash command line tool as a temporary measure.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
