{"schema_version":"1","data":[{"id":21826,"advisory_id":"f8fcbc39-eb89-4e84-bb71-6799667857c0","revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2022-2068","source_published_at":"2022-06-21T14:45:20.597+00:00","published_at":"2026-10-25T05:51:46.9367+00:00","extraction_method":"structured","technologies":["core-cve","openssl"],"cve_ids":["CVE-2022-2068"],"event_types":["advisory"],"payload":{"kind":"advisory","title":"The c_rehash script allows command injection","summary":"In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).","evidence":"cve:CVE-2022-2068","products":[{"name":{"value":"OpenSSL","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"unknown","structured":{"id":"CVE-2022-2068","aliases":["CVE-2022-2068"],"metrics":[{"other":{"type":"unknown","content":{"url":"https://www.openssl.org/policies/secpolicy.html#Moderate","lang":"eng","value":"Moderate"}}}],"affected":[{"vendor":"OpenSSL","product":"OpenSSL","versions":[{"status":"affected","version":"Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3)"},{"status":"affected","version":"Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o)"},{"status":"affected","version":"Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)"}]}],"modified":"2026-10-14T12:57:37.880Z","provider":"cve","references":["https://www.openssl.org/news/secadv/20220621.txt","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","https://www.debian.org/security/2022/dsa-5169","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","https://security.netapp.com/advisory/ntap-20220707-0008/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf"],"provider_metadata":{"adp":[{"title":"CVE Program Container","references":[{"url":"https://gitlab.com/fraf0/cve-2022-1292-re_score-analysis"},{"url":"https://www.openssl.org/news/secadv/20220621.txt","tags":["x_transferred"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa","tags":["x_transferred"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7","tags":["x_transferred"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9","tags":["x_transferred"]},{"url":"https://www.debian.org/security/2022/dsa-5169","name":"DSA-5169","tags":["vendor-advisory","x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6WZZBKUHQFGSKGNXXKICSRPL7AMVW5M5/","name":"FEDORA-2022-3b7d0abd0b","tags":["vendor-advisory","x_transferred"]},{"url":"https://security.netapp.com/advisory/ntap-20220707-0008/","tags":["x_transferred"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VCMNWKERPBKOEBNL7CLTTX3ZZCZLH7XA/","name":"FEDORA-2022-41890e9e44","tags":["vendor-advisory","x_transferred"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf","tags":["x_transferred"]},{"url":"http://seclists.org/fulldisclosure/2024/Nov/0"}],"providerMetadata":{"orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE","dateUpdated":"2025-11-03T21:45:47.155Z"}},{"title":"CISA ADP Vulnrichment","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":9.8,"attackVector":"NETWORK","baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","integrityImpact":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","availabilityImpact":"HIGH","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}},{"other":{"type":"ssvc","content":{"id":"CVE-2022-2068","role":"CISA Coordinator","options":[{"Exploitation":"poc"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2023-07-21T00:00:00+00:00"}}}],"problemTypes":[{"descriptions":[{"lang":"en","type":"CWE","cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')"}]}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2025-12-30T04:55:27.130Z"}},{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIMATIC S7-1500 TM MFP - GNU/Linux subsystem","versions":[{"status":"affected","version":"0","lessThan":"V1.1","versionType":"custom"}],"defaultStatus":"unknown"},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","versions":[{"status":"affected","version":"V3.1.0","lessThan":"V3.1.5","versionType":"custom"}],"defaultStatus":"unknown"}],"x_adpType":"supplier","references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-332410.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-146325.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html"}],"providerMetadata":{"orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP","dateUpdated":"2026-10-14T12:57:37.880Z"}}],"cna":{"orgId":"3a12439a-ef3a-4c79-92e6-6081a721f1e5","shortName":"openssl","dateUpdated":"2023-01-10T00:00:00.000Z"}}},"related_cves":[{"value":"CVE-2022-2068","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":null}}],"next_after":21826,"next_before":21826}