The c_rehash script allows command injection
OpenSSL · OpenSSL
The c_rehash script in OpenSSL fails to sanitise shell metacharacters in certificate file names passed to shell commands, causing OS command injection. On operating systems that automatically execute the script, an attacker can run arbitrary commands with the script's privileges, with no authentication, user interaction, or special configuration required beyond that automatic execution.
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
- Exploited
- Not confirmed
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
Disclosed on 21 Jun 2022. No public exploit code or confirmed exploitation is recorded.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 20 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- Clone Credit: Disable_Duck 3years ago | Title: Investigation of Distribution Vectors and Threat Net8 Aug 2026
- 14 more on OTX