IM
IronMonkey Threat Research

CVE-2022-2068 CRITICAL

Published: 2022-06-21 | Last Modified: 2025-11-03 | Status: Modified

Description

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Additional Descriptions (1)

Además de una inyección de comandos de shell c_rehash identificada en CVE-2022-1292, se encontraron otras circunstancias en las que el script c_rehash no sanea adecuadamente los metacaracteres de shell para evitar la inyección de comandos mediante la revisión del código. Cuando fue corregida la CVE-2022-1292 no ha sido detectado que se presentan otros lugares en el script en los que los nombres de archivo de los certificados a los que es aplicado el hash son pasados posiblemente a un comando ejecutado mediante el shell. Este script es distribuido por algunos sistemas operativos de manera que es ejecutado automáticamente. En dichos sistemas operativos, un atacante podría ejecutar comandos arbitrarios con los privilegios del script. El uso del script c_rehash es considerado obsoleto y debe ser sustituido por la herramienta de línea de comandos OpenSSL rehash. Corregido en OpenSSL versión 3.0.4 (Afectados 3.0.0,3.0.1,3.0.2,3.0.3). Corregido en OpenSSL versión 1.1.1p (Afectado 1.1.1-1.1.1o). Corregido en OpenSSL versión 1.0.2zf (Afectado 1.0.2-1.0.2ze)

CVSS Metrics

Base Score: 7.3 (HIGH)

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Attack VectorLOCAL
Attack ComplexityLOW
Privileges RequiredLOW
User InteractionREQUIRED
ScopeUNCHANGED
Confidentiality ImpactHIGH
Integrity ImpactHIGH
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.3

Impact Score: 5.9

Base Score: 10.0 (HIGH)

AV:N/AC:L/Au:N/C:C/I:C/A:C

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactCOMPLETE
Integrity ImpactCOMPLETE
Availability ImpactCOMPLETE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 10.0

Weaknesses

Source Type Description
[email protected] Primary
en CWE-78
134c704f-9b21-4f2e-91b3-4a467353bcc0 Secondary
en CWE-78

Affected Products

Vendor Product Version Update Type
openssl openssl * <built-in method update of dict object at 0x7fd36960f500> Application
openssl openssl * <built-in method update of dict object at 0x7fd36960ee80> Application
openssl openssl * <built-in method update of dict object at 0x7fd36960fe80> Application
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd384a67a40> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd384a671c0> Operating System
fedoraproject fedora 35 <built-in method update of dict object at 0x7fd384a659c0> Operating System
fedoraproject fedora 36 <built-in method update of dict object at 0x7fd384a674c0> Operating System
siemens sinec_ins * <built-in method update of dict object at 0x7fd36960f000> Application
siemens sinec_ins 1.0 <built-in method update of dict object at 0x7fd36960d280> Application
siemens sinec_ins 1.0 <built-in method update of dict object at 0x7fd36960ea80> Application
siemens sinec_ins 1.0 <built-in method update of dict object at 0x7fd36960d140> Application
netapp element_software - <built-in method update of dict object at 0x7fd36960e600> Application
netapp hci_management_node - <built-in method update of dict object at 0x7fd3695d8340> Application
netapp ontap_antivirus_connector - <built-in method update of dict object at 0x7fd38463bd80> Application
netapp ontap_select_deploy_administration_utility - <built-in method update of dict object at 0x7fd3848e2ac0> Application
netapp santricity_smi-s_provider - <built-in method update of dict object at 0x7fd39c449740> Application
netapp smi-s_provider - <built-in method update of dict object at 0x7fd2d82599c0> Application
netapp snapmanager - <built-in method update of dict object at 0x7fd2d399bb40> Application
netapp solidfire - <built-in method update of dict object at 0x7fd2d825a7c0> Application
netapp bootstrap_os - <built-in method update of dict object at 0x7fd384e107c0> Operating System
netapp h615c_firmware - <built-in method update of dict object at 0x7fd3840e4800> Operating System
netapp h610s_firmware - <built-in method update of dict object at 0x7fd2d399a300> Operating System
netapp h610c_firmware - <built-in method update of dict object at 0x7fd36b261c80> Operating System
netapp h410c_firmware - <built-in method update of dict object at 0x7fd340cc6600> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd384e13500> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd3848e1d40> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd36b263300> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd34b9a4900> Operating System
netapp fas_8300_firmware - <built-in method update of dict object at 0x7fd34231b240> Operating System
netapp fas_8700_firmware - <built-in method update of dict object at 0x7fd2dbf40bc0> Operating System
netapp fas_a400_firmware - <built-in method update of dict object at 0x7fd384e11c80> Operating System
netapp aff_8300_firmware - <built-in method update of dict object at 0x7fd2d3999c00> Operating System
netapp aff_8700_firmware - <built-in method update of dict object at 0x7fd3848e1400> Operating System
netapp aff_a400_firmware - <built-in method update of dict object at 0x7fd2dbcdc9c0> Operating System
broadcom sannav - <built-in method update of dict object at 0x7fd369f83740> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
Yes cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*
Yes cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
Yes cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:fas_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:broadcom:sannav:-:*:*:*:*:*:*:*

References