The c_rehash script allows command injection
OpenSSL · OpenSSL
The c_rehash script in OpenSSL does not properly sanitise shell metacharacters, which enables command injection in that component. On operating systems that automatically execute the script, an attacker can run arbitrary commands with the script's privileges.
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Public exploit code (PoC-in-GitHub) appeared 21 days after disclosure. No confirmed exploitation is recorded.
- Disclosedday 0
- Public exploit codePoC-in-GitHub+21 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 26 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- 20 more on OTX