DSA-5169: -1 openssl -- security update

Published Jun 26, 2022

Updated

It was discovered that the crehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands.

Affected Software

2 affected components

debian/openssl

Event History

Jun 26, 2022

Advisory Published

12:00 AM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2022-2068

Frequently Asked Questions

What conditions are required for exploitation?

An attacker would need a way to cause c_rehash to process input containing shell metacharacters. The issue arises because the script does not sanitize those characters before they can lead to command execution.

Which component should administrators examine when assessing exposure?

Administrators should identify uses of the c_rehash script included with OpenSSL, particularly workflows that process certificate or other input from untrusted sources. The provided information does not establish whether a default configuration invokes c_rehash automatically.

DSA-5169: -1 openssl -- security update

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are required for exploitation?

Which component should administrators examine when assessing exposure?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

Which component should administrators examine when assessing exposure?