CVE-2022-1292

EPSS 82.61%
Veröffentlicht 03.05.2022 16:15:18
Zuletzt bearbeitet 13.08.2025 14:15:28
Erkennungen
Login

The c_rehash script allows command injection

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Betroffene Produkte Warnungen 0 Metriken 4 CWE 1 Referenzen 18

NVD 41 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Siemens ≫ Brownfield Connectivity Gateway Version < 2.15

OpenSSL ≫ OpenSSL Version >= 1.0.2 < 1.0.2ze

OpenSSL ≫ OpenSSL Version >= 1.1.1 < 1.1.1o

OpenSSL ≫ OpenSSL Version >= 3.0.0 < 3.0.3

Debian ≫ Debian Linux Version 9.0

Debian ≫ Debian Linux Version 10.0

Debian ≫ Debian Linux Version 11.0

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vmware_vsphere

Netapp ≫ Active Iq Unified Manager Version - SwPlatform vsphere

Netapp ≫ Active Iq Unified Manager Version - SwPlatform windows

Netapp ≫ Clustered Data Ontap Version -

Netapp ≫ Clustered Data Ontap Antivirus Connector Version -

Netapp ≫ Oncommand Insight Version -

Netapp ≫ Oncommand Workflow Automation Version -

Netapp ≫ Santricity Smi-s Provider Version -

Netapp ≫ Smi-s Provider Version -

Netapp ≫ Snapcenter Version -

Netapp ≫ Snapmanager Version - SwPlatform hyper-v

Netapp ≫ A700s Firmware Version -

Netapp ≫ A700s Version -

Netapp ≫ H300s Firmware Version -

Netapp ≫ H300s Version -

Netapp ≫ H500s Firmware Version -

Netapp ≫ H500s Version -

Netapp ≫ H700s Firmware Version -

Netapp ≫ H700s Version -

Netapp ≫ H300e Firmware Version -

Netapp ≫ H300e Version -

Netapp ≫ H500e Firmware Version -

Netapp ≫ H500e Version -

Netapp ≫ H700e Firmware Version -

Netapp ≫ H700e Version -

Netapp ≫ H410s Firmware Version -

Netapp ≫ H410s Version -

Netapp ≫ Aff 8300 Firmware Version -

Netapp ≫ Aff 8300 Version -

Netapp ≫ Fas 8300 Firmware Version -

Netapp ≫ Fas 8300 Version -

Netapp ≫ Aff 8700 Firmware Version -

Netapp ≫ Aff 8700 Version -

Netapp ≫ Fas 8700 Firmware Version -

Netapp ≫ Fas 8700 Version -

Netapp ≫ Aff A400 Firmware Version -

Netapp ≫ Aff A400 Version -

Netapp ≫ Fabric-attached Storage A400 Firmware Version -

Netapp ≫ Fabric-attached Storage A400 Version -

Netapp ≫ A250 Firmware Version -

Netapp ≫ A250 Version -

Netapp ≫ Aff 500f Firmware Version -

Netapp ≫ Aff 500f Version -

Netapp ≫ Fas 500f Firmware Version -

Netapp ≫ Fas 500f Version -

Oracle ≫ Enterprise Manager Ops Center Version 12.4.0.0

Oracle ≫ Mysql Server Version >= 5.0.0 <= 5.7.38

Oracle ≫ Mysql Server Version >= 8.0.0 <= 8.0.29

Oracle ≫ Mysql Workbench Version <= 8.0.29

Fedoraproject ≫ Fedora Version 35

Fedoraproject ≫ Fedora Version 36

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	82.61%	0.996

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	7.3	1.3	5.9	CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NIST	10	10	10	AV:N/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

https://www.oracle.com/security-alerts/cpujul2022.html

Third Party Advisory

https://security.gentoo.org/glsa/202210-02

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220729-0004/

Third Party Advisory

https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf

Third Party Advisory

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2

Broken Link

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb

Broken Link

https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23

Broken Link

https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/

Third Party Advisory

Mailing List

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/

Third Party Advisory

Mailing List

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011

Third Party Advisory

https://security.netapp.com/advisory/ntap-20220602-0009/

Third Party Advisory

https://www.debian.org/security/2022/dsa-5139

Third Party Advisory

https://www.openssl.org/news/secadv/20220503.txt

Vendor Advisory

https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis

https://nvd.nist.gov/vuln/detail/CVE-2022-1292

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-1292

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-1292

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2022-1292