Command Injection in OpenSSL c_rehash Script (CVE-2022-2068)
Summary
CVE-2022-2068: In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by... Affects openssl across 2 version ranges.
< 0
>= 89cd17a031e022211684eb7eb41190cf1910f9fa, < 54f5fca0d0b15f912e7355a378976cbff12d58fc
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenSSL is a widely-used open-source cryptographic library that provides support for secure communications and cryptographic protocols. It is used by various operating systems and applications to implement secure communication channels. The c_rehash script is a utility provided by OpenSSL to create symbolic links to certificate files in a directory, making it easier to access and manage certificates. However, the c_rehash script is vulnerable to command injection, allowing an attacker to execute arbitrary commands with the privileges of the script.
Vulnerability Detail
The c_rehash script in OpenSSL does not properly sanitize shell metacharacters, leading to command injection. This vulnerability was initially identified as CVE-2022-1292, but further code review revealed additional places in the script where file names of certificates being hashed were possibly passed to a command executed through the shell. On operating systems where the c_rehash script is automatically executed, an attacker can exploit this vulnerability to execute arbitrary commands with the privileges of the script. The use of the c_rehash script is considered obsolete, and it is recommended to replace it with the OpenSSL rehash command line tool.
How To Fix
To fix this vulnerability, it is recommended to update OpenSSL to the latest version. The vulnerability has been fixed in OpenSSL 3.0.4, OpenSSL 1.1.1p, and OpenSSL 1.0.2zf. Users should update their OpenSSL installations to one of these fixed versions. Additionally, it is advised to replace the use of the c_rehash script with the OpenSSL rehash command line tool.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, users can mitigate the risk by ensuring that the c_rehash script is not automatically executed on their operating systems. Disabling the automatic execution of the script can prevent potential exploitation of this vulnerability.
Conclusion
The command injection vulnerability in the OpenSSL c_rehash script (CVE-2022-2068) allows an attacker to execute arbitrary commands with the privileges of the script. It is recommended to update OpenSSL to a fixed version and replace the use of the c_rehash script with the OpenSSL rehash command line tool. Applying these fixes will help mitigate the risk of potential exploitation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for openssl →
FAQ
This vulnerability allows an attacker to execute arbitrary commands with the privileges of the c_rehash script. Depending on the privileges of the script, this can lead to unauthorized access, data manipulation, or further compromise of the system.
If you are using an affected version of OpenSSL and the c_rehash script is automatically executed on your operating system, your system is potentially vulnerable. It is recommended to update OpenSSL to a fixed version and replace the use of the c_rehash script.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes and security updates to mitigate the risk of potential exploitation.
While it is possible to apply additional precautions and input validation to the c_rehash script, it is strongly recommended to replace its usage with the OpenSSL rehash command line tool. The c_rehash script is considered obsolete and may have other undiscovered vulnerabilities.
For more information about the fixed versions of OpenSSL, including release notes and download links, you can visit the official OpenSSL website or consult the documentation provided by your operating system or distribution.
References
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
