exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New
Showing 26 - 35 of 35 RSS Feed

CVE-2022-2068

Status Candidate

Overview

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Related Files

Red Hat Security Advisory 2022-6156-01
Posted Aug 25, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6156-01 - Red Hat OpenShift Data Foundation is software-defined storage integrated with and optimized for the Red Hat OpenShift Container Platform. Red Hat OpenShift Data Foundation is a highly scalable, production-grade persistent storage for stateful applications running in the Red Hat OpenShift Container Platform. Issues addressed include bypass, denial of service, information leakage, and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2021-23440, CVE-2021-23566, CVE-2021-40528, CVE-2022-0235, CVE-2022-0536, CVE-2022-0670, CVE-2022-1292, CVE-2022-1586, CVE-2022-1650, CVE-2022-1785, CVE-2022-1897, CVE-2022-1927, CVE-2022-2068, CVE-2022-2097
SHA-256 | 5fabfb2a27df6ddd945cca828f5636df86c99cda05ab36451913c7c952c7372d
Red Hat Security Advisory 2022-6103-01
Posted Aug 24, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6103-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.11.1.

tags | advisory
systems | linux, redhat
advisories | CVE-2022-1012, CVE-2022-1292, CVE-2022-1586, CVE-2022-1785, CVE-2022-1897, CVE-2022-1927, CVE-2022-2068, CVE-2022-2097, CVE-2022-30629, CVE-2022-30631, CVE-2022-32250
SHA-256 | 9ed4a54b3aed43ac3112247709b1be7d05294778451baf8ae63150805dcdde86
Red Hat Security Advisory 2022-6051-01
Posted Aug 19, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6051-01 - An update is now available for RHOL-5.5-RHEL-8. Issues addressed include denial of service, man-in-the-middle, and out of bounds read vulnerabilities.

tags | advisory, denial of service, vulnerability
systems | linux, redhat
advisories | CVE-2021-38561, CVE-2022-0759, CVE-2022-1012, CVE-2022-1292, CVE-2022-1586, CVE-2022-1785, CVE-2022-1897, CVE-2022-1927, CVE-2022-2068, CVE-2022-2097, CVE-2022-21698, CVE-2022-30631, CVE-2022-32250
SHA-256 | 34dbc339b99387a91824a2ceb744350fc879ba77db776d936b2aebbd0812265e
Red Hat Security Advisory 2022-6024-01
Posted Aug 10, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-6024-01 - Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support services. This new container image is based on Red Hat Ceph Storage 5.2 and Red Hat Enterprise Linux 8.6 and Red Hat Enterprise Linux 9. Issues addressed include a traversal vulnerability.

tags | advisory
systems | linux, redhat
advisories | CVE-2021-40528, CVE-2021-43813, CVE-2022-0670, CVE-2022-1292, CVE-2022-1586, CVE-2022-1785, CVE-2022-1897, CVE-2022-1927, CVE-2022-2068, CVE-2022-2097, CVE-2022-21673, CVE-2022-22576, CVE-2022-25313, CVE-2022-25314
SHA-256 | e52fb3bea97275ad943bc6b64258f5d9ee9ee01ef78ecf3d9c444d899bebb1ef
Red Hat Security Advisory 2022-5818-01
Posted Aug 4, 2022
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2022-5818-01 - OpenSSL is a toolkit that implements the Secure Sockets Layer and Transport Layer Security protocols, as well as a full-strength general-purpose cryptography library. Issues addressed include a code execution vulnerability.

tags | advisory, code execution, protocol
systems | linux, redhat
advisories | CVE-2022-1292, CVE-2022-2068, CVE-2022-2097
SHA-256 | 61fd4ae020a65fbaad40f03e903e5c409d9a67ad1b8ac30645648f96edbe5e69
Ubuntu Security Notice USN-5488-2
Posted Jul 7, 2022
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 5488-2 - USN-5488-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 16.04 ESM. Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run.

tags | advisory, arbitrary, local, vulnerability
systems | linux, ubuntu
advisories | CVE-2022-2068
SHA-256 | 6343962f5bd4054fea3153ddc0d37cba8a263f70397cccc8e49318af82918d33
Debian Security Advisory 5169-1
Posted Jun 28, 2022
Authored by Debian | Site debian.org

Debian Linux Security Advisory 5169-1 - It was discovered that the c_rehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands.

tags | advisory, arbitrary, shell
systems | linux, debian
advisories | CVE-2022-2068
SHA-256 | 25695a8fea8e3f567226ee9953cdcf95ee99ad75b984a86999b78293364562f4
Ubuntu Security Notice USN-5488-1
Posted Jun 21, 2022
Authored by Ubuntu | Site security.ubuntu.com

Ubuntu Security Notice 5488-1 - Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the c_rehash script. A local attacker could possibly use this issue to execute arbitrary commands when c_rehash is run.

tags | advisory, arbitrary, local
systems | linux, ubuntu
advisories | CVE-2022-2068
SHA-256 | 5a9ce5992671e1b5986783112d991cf1a7ac72fd0b20a0774485aa00e5df67c0
OpenSSL Toolkit 1.1.1p
Posted Jun 21, 2022
Site openssl.org

OpenSSL is a robust, fully featured Open Source toolkit implementing the Secure Sockets Layer (SSL v2/v3) and Transport Layer Security (TLS v1) protocols with full-strength cryptography world-wide.

Changes: Fixed additional bugs in the c_rehash script which was not properly sanitizing shell metacharacters to prevent command injection.
tags | tool, encryption, protocol
systems | unix
advisories | CVE-2022-2068
SHA-256 | bf61b62aaa66c7c7639942a94de4c9ae8280c08f17d4eac2e44644d9fc8ace6f
OpenSSL Security Advisory 20220621
Posted Jun 21, 2022
Site openssl.org

OpenSSL Security Advisory 20220621 - In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review.

tags | advisory, shell
advisories | CVE-2022-1292, CVE-2022-2068
SHA-256 | a632f42aad9bc1de330d7aef358f76b215a0921218449031cf1f2077b68dff3a
Page 2 of 2
Back12Next

File Archive:

April 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    10 Files
  • 2
    Apr 2nd
    26 Files
  • 3
    Apr 3rd
    40 Files
  • 4
    Apr 4th
    6 Files
  • 5
    Apr 5th
    26 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    22 Files
  • 9
    Apr 9th
    14 Files
  • 10
    Apr 10th
    10 Files
  • 11
    Apr 11th
    13 Files
  • 12
    Apr 12th
    14 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    30 Files
  • 16
    Apr 16th
    10 Files
  • 17
    Apr 17th
    22 Files
  • 18
    Apr 18th
    45 Files
  • 19
    Apr 19th
    8 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    11 Files
  • 23
    Apr 23rd
    68 Files
  • 24
    Apr 24th
    23 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close