DSA-5139: -1 openssl -- security update

Published May 17, 2022

Updated

Elison Niven discovered that the crehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands.

Affected Software

2 affected components

debian/openssl

Event History

May 17, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-1292

Frequently Asked Questions

Which Debian package should be included in an exposure review?

The affected software entry is debian/openssl. The issue is described in the c_rehash script included with OpenSSL.

Are affected or fixed package versions available in this advisory data?

No affected or fixed version numbers are provided. Package version status cannot be determined from the supplied information alone.

Which identifiers can be used to correlate this issue with vulnerability and advisory tracking?

The referenced vulnerability is CVE-2022-1292, and the Debian advisory identifier is DSA-5139-1.

DSA-5139: -1 openssl -- security update

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

Which Debian package should be included in an exposure review?

Are affected or fixed package versions available in this advisory data?

Which identifiers can be used to correlate this issue with vulnerability and advisory tracking?

Company

Resources

Contact

Frequently Asked Questions

Which Debian package should be included in an exposure review?

Are affected or fixed package versions available in this advisory data?

Which identifiers can be used to correlate this issue with vulnerability and advisory tracking?