Search for packages
| purl | pkg:openssl/openssl@1.0.2ze |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-w17h-u8wd-aaaj
Aliases: CVE-2022-2068 VC-OPENSSL-20220621-CVE-2022-2068 |
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). |
Affected by 0 other vulnerabilities. Affected by 1 other vulnerability. Affected by 5 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-yrx6-rcrr-aaap | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). |
CVE-2022-1292
VC-OPENSSL-20220503-CVE-2022-1292 |
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2024-01-03T20:01:26.378595+00:00 | OpenSSL Importer | Fixing | VCID-yrx6-rcrr-aaap | https://www.openssl.org/news/secadv/20220503.txt | 34.0.0rc1 |
| 2024-01-03T20:01:26.069651+00:00 | OpenSSL Importer | Affected by | VCID-w17h-u8wd-aaaj | https://www.openssl.org/news/secadv/20220621.txt | 34.0.0rc1 |