CVE-2022-1292 The c_rehash script allows command injection

Critical 9.8 Published 3 May 2022 Updated 14 Oct 2026

Attackers can execute arbitrary commands via the c_rehash script due to improper sanitization of shell metacharacters, affecting OpenSSL users.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-1292?

CVE-2022-1292 is a critical command injection vulnerability in Debian Debian Linux, published on 3 May 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Weakness: CWE-78

Which versions are affected by CVE-2022-1292?

It affects 35 products.

Linux distribution packages (25)

`openssl-1_1` SUSE:Enterprise Storage 6	All versions	`1.1.0i-150100.14.30.1`
`openssl` SUSE:HPE Helion OpenStack 8	All versions	`1.0.2j-60.80.1`
`openssl-1_1` SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS	All versions	`1.1.0i-150100.14.30.1`
`openssl-1_1` SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS	All versions	`1.1.0i-150100.14.30.1`
`openssl-1_1` SUSE:Linux Enterprise High Performance Computing 15-ESPOS	All versions	`1.1.0i-150000.4.69.1`
`openssl-1_1` SUSE:Linux Enterprise High Performance Computing 15-LTSS	All versions	`1.1.0i-150000.4.69.1`
`openssl` SUSE:Linux Enterprise Server 12 SP2-BCL	All versions	`1.0.2j-60.80.1`
`openssl` SUSE:Linux Enterprise Server 12 SP3-BCL	All versions	`1.0.2j-60.80.1`
`openssl` SUSE:Linux Enterprise Server 12 SP3-LTSS	All versions	`1.0.2j-60.80.1`
`openssl-1_0_0` SUSE:Linux Enterprise Server 12 SP4-LTSS	All versions	`1.0.2p-3.53.1`
`openssl-1_0_0` SUSE:Linux Enterprise Server 12 SP5	All versions	`1.0.2p-3.53.1`
`openssl-1_1` SUSE:Linux Enterprise Server 15 SP1-BCL	All versions	`1.1.0i-150100.14.30.1`
`openssl-1_1` SUSE:Linux Enterprise Server 15 SP1-LTSS	All versions	`1.1.0i-150100.14.30.1`
`openssl-1_1` SUSE:Linux Enterprise Server 15-LTSS	All versions	`1.1.0i-150000.4.69.1`
`openssl` SUSE:Linux Enterprise Server for SAP Applications 12 SP3	All versions	`1.0.2j-60.80.1`
`openssl-1_0_0` SUSE:Linux Enterprise Server for SAP Applications 12 SP4	All versions	`1.0.2p-3.53.1`
`openssl-1_0_0` SUSE:Linux Enterprise Server for SAP Applications 12 SP5	All versions	`1.0.2p-3.53.1`
`openssl-1_1` SUSE:Linux Enterprise Server for SAP Applications 15	All versions	`1.1.0i-150000.4.69.1`
`openssl-1_1` SUSE:Linux Enterprise Server for SAP Applications 15 SP1	All versions	`1.1.0i-150100.14.30.1`
`openssl-1_0_0` SUSE:Linux Enterprise Software Development Kit 12 SP5	All versions	`1.0.2p-3.53.1`
`openssl` SUSE:OpenStack Cloud 8	All versions	`1.0.2j-60.80.1`
`openssl-1_0_0` SUSE:OpenStack Cloud 9	All versions	`1.0.2p-3.53.1`
`openssl` SUSE:OpenStack Cloud Crowbar 8	All versions	`1.0.2j-60.80.1`
`openssl-1_0_0` SUSE:OpenStack Cloud Crowbar 9	All versions	`1.0.2p-3.53.1`
`openssl-1_1` openSUSE:Tumbleweed	All versions	`1.1.1o-1.1`

Products include Debian Debian Linux, Fedoraproject Fedora, Netapp A250 Firmware, Netapp A700s Firmware, Netapp Active Iq Unified Manager, Netapp Aff 500f Firmware and 29 more.

How do I fix CVE-2022-1292?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-1292 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1292 exists.

Public exploit code: 5 proofs of concept on GitHub.

All Debian Debian Linux vulnerabilities

Sources

Also known as AZL-41748, AZL-9649, DEBIAN-CVE-2022-1292, DLA-3008-1, DSA-5139-1, GHSA-qjmp-vmxc-7p8r and 10 more.