CVE-2022-2068 The c_rehash script allows command injection
Attackers can execute arbitrary commands via the c_rehash script due to improper sanitization of shell metacharacters in certificate filenames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-2068?
CVE-2022-2068 is a critical command injection vulnerability in Debian Debian Linux, published on 21 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
Weakness: CWE-78
Which versions are affected by CVE-2022-2068?
It affects 28 products.
Linux distribution packages (21)
openssl-1_1 SUSE:Enterprise Storage 6 | All versions | 1.1.0i-150100.14.33.1 |
openssl SUSE:HPE Helion OpenStack 8 | All versions | 1.0.2j-60.83.1 |
openssl-1_1 SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS | All versions | 1.1.0i-150100.14.33.1 |
openssl-1_1 SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS | All versions | 1.1.0i-150100.14.33.1 |
openssl SUSE:Linux Enterprise Server 12 SP2-BCL | All versions | 1.0.2j-60.83.1 |
openssl SUSE:Linux Enterprise Server 12 SP3-BCL | All versions | 1.0.2j-60.83.1 |
openssl SUSE:Linux Enterprise Server 12 SP3-LTSS | All versions | 1.0.2j-60.83.1 |
openssl-1_0_0 SUSE:Linux Enterprise Server 12 SP4-LTSS | All versions | 1.0.2p-3.56.1 |
openssl-1_0_0 SUSE:Linux Enterprise Server 12 SP5 | All versions | 1.0.2p-3.56.1 |
openssl-1_1 SUSE:Linux Enterprise Server 15 SP1-BCL | All versions | 1.1.0i-150100.14.33.1 |
openssl-1_1 SUSE:Linux Enterprise Server 15 SP1-LTSS | All versions | 1.1.0i-150100.14.33.1 |
openssl SUSE:Linux Enterprise Server for SAP Applications 12 SP3 | All versions | 1.0.2j-60.83.1 |
openssl-1_0_0 SUSE:Linux Enterprise Server for SAP Applications 12 SP4 | All versions | 1.0.2p-3.56.1 |
openssl-1_0_0 SUSE:Linux Enterprise Server for SAP Applications 12 SP5 | All versions | 1.0.2p-3.56.1 |
openssl-1_1 SUSE:Linux Enterprise Server for SAP Applications 15 SP1 | All versions | 1.1.0i-150100.14.33.1 |
openssl-1_0_0 SUSE:Linux Enterprise Software Development Kit 12 SP5 | All versions | 1.0.2p-3.56.1 |
openssl SUSE:OpenStack Cloud 8 | All versions | 1.0.2j-60.83.1 |
openssl-1_0_0 SUSE:OpenStack Cloud 9 | All versions | 1.0.2p-3.56.1 |
openssl SUSE:OpenStack Cloud Crowbar 8 | All versions | 1.0.2j-60.83.1 |
openssl-1_0_0 SUSE:OpenStack Cloud Crowbar 9 | All versions | 1.0.2p-3.56.1 |
openssl-1_1 openSUSE:Tumbleweed | All versions | 1.1.1p-1.1 |
Products include Broadcom Sannav, Debian Debian Linux, Fedoraproject Fedora, Netapp Aff 8300 Firmware, Netapp Aff 8700 Firmware, Netapp Aff A400 Firmware and 22 more.
How do I fix CVE-2022-2068?
Upgrade to a fixed version.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2022-2068 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-2068 exists.
Other vulnerabilities in Debian Debian Linux
- CVE-2022-28163 SQL injection in Brocade SANNav
- CVE-2020-15377 Server-side request forgery in Brocade SANnav
- CVE-2022-28165 Missing authorization in Brocade SANNav
- CVE-2025-12772 Plaintext Switch admin login password is seen in Brocade SANnav support save
- CVE-2022-28166 Weak cryptography in Brocade SANnav
Sources
Also known as AZL-9967, DEBIAN-CVE-2022-2068, DSA-5169-1, GHSA-xjxr-x4h8-946x, JLSEC-2026-229, MGASA-2022-0246 and 8 more.