CVE-2022-2068

Published on: Not Yet Published

Last Modified on: 03/01/2023 04:23:00 PM UTC

CVE-2022-2068

Source: Mitre Source: NIST CVE.ORG Print: PDF PDF
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Certain versions of Sannav from Broadcom contain the following vulnerability:

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

  • CVE-2022-2068 has been assigned by URL Logo [email protected] to track the vulnerability - currently rated as CRITICAL severity.
  • Affected Vendor/Software: URL Logo OpenSSL - OpenSSL version Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3)
  • Affected Vendor/Software: URL Logo OpenSSL - OpenSSL version Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o)
  • Affected Vendor/Software: URL Logo OpenSSL - OpenSSL version Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)

CVSS3 Score: 9.8 - CRITICAL

Attack
Vector ⓘ		 Attack
Complexity		 Privileges
Required		 User
Interaction
NETWORK LOW NONE NONE
Scope Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
UNCHANGED HIGH HIGH HIGH

CVSS2 Score: 10 - HIGH

Access
Vector ⓘ		 Access
Complexity		 Authentication
NETWORK LOW NONE
Confidentiality
Impact		 Integrity
Impact		 Availability
Impact
COMPLETE COMPLETE COMPLETE

CVE References

Description Tags ⓘ Link
Debian -- Security Information -- DSA-5169-1 openssl www.debian.org
Depreciated Link
text/html
 URL Logo DEBIAN DSA-5169
git.openssl.org Git - openssl.git/commitdiff git.openssl.org
text/xml
Inactive LinkNot Archived
 URL Logo CONFIRM git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9
[SECURITY] Fedora 35 Update: openssl-1.1.1q-1.fc35 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
 URL Logo FEDORA FEDORA-2022-41890e9e44
[SECURITY] Fedora 36 Update: openssl1.1-1.1.1p-1.fc36 - package-announce - Fedora Mailing-Lists lists.fedoraproject.org
text/html
 URL Logo FEDORA FEDORA-2022-3b7d0abd0b
www.openssl.org
text/plain
 URL Logo CONFIRM www.openssl.org/news/secadv/20220621.txt
cert-portal.siemens.com
application/pdf
 URL Logo CONFIRM cert-portal.siemens.com/productcert/pdf/ssa-332410.pdf
git.openssl.org Git - openssl.git/commitdiff git.openssl.org
text/xml
 URL Logo CONFIRM git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2c9c35870601b4a44d86ddbf512b38df38285cfa
CVE-2022-2068 OpenSSL Vulnerability in NetApp Products | NetApp Product Security security.netapp.com
text/html
 URL Logo CONFIRM security.netapp.com/advisory/ntap-20220707-0008/
git.openssl.org Git - openssl.git/commitdiff git.openssl.org
text/xml
 URL Logo CONFIRM git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=9639817dac8bbbaa64d09efad7464ccc405527c7
By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].

Related QID Numbers

  • 160014 Oracle Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (ELSA-2022-5818)
  • 160025 Oracle Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (ELSA-2022-9683)
  • 160072 Oracle Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (ELSA-2022-6224)
  • 179493 Debian Security Update for Open Secure Sockets Layer (OpenSSL) (DSA 5169-1)
  • 198839 Ubuntu Security Notification for Open Secure Sockets Layer (OpenSSL) Vulnerability (USN-5488-1)
  • 240588 Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2022:5818)
  • 240641 Red Hat Update for Open Secure Sockets Layer (OpenSSL) (RHSA-2022:6224)
  • 240996 Red Hat Update for JBoss Core Services (RHSA-2022:8840)
  • 282896 Fedora Security Update for openssl1.1 (FEDORA-2022-3b7d0abd0b)
  • 282968 Fedora Security Update for Open Secure Sockets Layer (OpenSSL) (FEDORA-2022-41890e9e44)
  • 296084 Oracle Solaris 11.4 Support Repository Update (SRU) 50.126.3 Missing (CPUOCT2022)
  • 296085 Oracle Solaris 11.3 Support Repository Update (SRU) 36.30.0 Missing (CPUOCT2022)
  • 330109 IBM Advanced Interactive eXecutive (AIX) Open Secure Sockets Layer (OpenSSL) Arbritary Code Execution Vulnerability (openssl_advisory36)
  • 354035 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS-2022-1626
  • 354040 Amazon Linux Security Advisory for Open Secure Sockets Layer11 (OpenSSL11) : ALAS2-2022-1832
  • 354042 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2-2022-1831
  • 354371 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2022-2022-123
  • 354459 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2022-2022-195
  • 354579 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS-2022-195
  • 354639 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : AL2012-2022-371
  • 355250 Amazon Linux Security Advisory for Open Secure Sockets Layer (OpenSSL) : ALAS2023-2023-051
  • 377563 Alibaba Cloud Linux Security Update for Open Secure Sockets Layer (OpenSSL) (ALINUX3-SA-2022:0148)
  • 377937 Splunk Enterprise Multiple Vulnerabilities (svd-2022-0804)
  • 38895 Open Secure Sockets Layer (OpenSSL) Command Injection Vulnerability
  • 591193 Mitsubishi Electric GT SoftGOT2000 OS COMMAND INJECTION Vulnerability (ICSA-22-319-01, 2022-012)
  • 591406 Siemens SIMATIC S7-1500 CPU GNU/Linux subsystem Multiple Vulnerabilities (SSB-439005, ICSA-22-104-13)
  • 672020 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2228)
  • 672054 EulerOS Security Update for compat-openssl (EulerOS-SA-2022-2215)
  • 672094 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2300)
  • 672096 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2329)
  • 672153 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2446)
  • 672162 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2419)
  • 672172 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2432)
  • 672251 EulerOS Security Update for Open Secure Sockets Layer (OpenSSL) (EulerOS-SA-2022-2629)
  • 672447 EulerOS Security Update for linux-sgx (EulerOS-SA-2022-2852)
  • 690881 Free Berkeley Software Distribution (FreeBSD) Security Update for Open Secure Sockets Layer (OpenSSL) (4eeb93bf-f204-11ec-8fbd-d4c9ef517024)
  • 730739 IBM Aspera Faspex Multiple Security Vulnerabilities (6952319)
  • 752266 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (SUSE-SU-2022:2181-1)
  • 752269 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (SUSE-SU-2022:2180-1)
  • 752272 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (SUSE-SU-2022:2179-1)
  • 752273 SUSE Enterprise Linux Security Update for openssl-1_1 (SUSE-SU-2022:2182-1)
  • 752280 SUSE Enterprise Linux Security Update for openssl-1_0_0 (SUSE-SU-2022:2197-1)
  • 752283 SUSE Enterprise Linux Security Update for openssl-1_1 (SUSE-SU-2022:2251-1)
  • 752298 SUSE Enterprise Linux Security Update for openssl-1_1 (SUSE-SU-2022:2308-1)
  • 752301 SUSE Enterprise Linux Security Update for Open Secure Sockets Layer (OpenSSL) (SUSE-SU-2022:2309-1)
  • 752308 SUSE Enterprise Linux Security Update for openssl-3 (SUSE-SU-2022:2306-1)
  • 752323 SUSE Enterprise Linux Security Update for openssl-1_0_0 (SUSE-SU-2022:2321-1)
  • 902361 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (9971)
  • 902363 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (9967)
  • 902389 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (9967-1)
  • 902477 Common Base Linux Mariner (CBL-Mariner) Security Update for Open Secure Sockets Layer (OpenSSL) (9971-1)
  • 940611 AlmaLinux Security Update for Open Secure Sockets Layer (OpenSSL) (ALSA-2022:5818)
  • 940649 AlmaLinux Security Update for Open Secure Sockets Layer (OpenSSL) (ALSA-2022:6224)
  • 960214 Rocky Linux Security Update for Open Secure Sockets Layer (OpenSSL) (RLSA-2022:5818)

Known Affected Configurations (CPE V2.3)

Type Vendor Product Version Update Edition Language
ApplicationBroadcomSannav-AllAllAll
Operating
System		DebianDebian Linux10.0AllAllAll
Operating
System		DebianDebian Linux11.0AllAllAll
Operating
System		FedoraprojectFedora35AllAllAll
Operating
System		FedoraprojectFedora36AllAllAll
Hardware Device InfoNetappAff 8300-AllAllAll
Operating
System		NetappAff 8300 Firmware-AllAllAll
Hardware Device InfoNetappAff 8700-AllAllAll
Operating
System		NetappAff 8700 Firmware-AllAllAll
Hardware Device InfoNetappAff A400-AllAllAll
Operating
System		NetappAff A400 Firmware-AllAllAll
Operating
System		NetappBootstrap Os-AllAllAll
ApplicationNetappElement Software-AllAllAll
Hardware Device InfoNetappFas 8300-AllAllAll
Operating
System		NetappFas 8300 Firmware-AllAllAll
Hardware Device InfoNetappFas 8700-AllAllAll
Operating
System		NetappFas 8700 Firmware-AllAllAll
Hardware Device InfoNetappFas A400-AllAllAll
Operating
System		NetappFas A400 Firmware-AllAllAll
Hardware Device InfoNetappH300s-AllAllAll
Operating
System		NetappH300s Firmware-AllAllAll
Hardware Device InfoNetappH410c-AllAllAll
Operating
System		NetappH410c Firmware-AllAllAll
Hardware Device InfoNetappH410s-AllAllAll
Operating
System		NetappH410s Firmware-AllAllAll
Hardware Device InfoNetappH500s-AllAllAll
Operating
System		NetappH500s Firmware-AllAllAll
Hardware Device InfoNetappH610c-AllAllAll
Operating
System		NetappH610c Firmware-AllAllAll
Hardware Device InfoNetappH610s-AllAllAll
Operating
System		NetappH610s Firmware-AllAllAll
Hardware Device InfoNetappH615c-AllAllAll
Operating
System		NetappH615c Firmware-AllAllAll
Hardware Device InfoNetappH700s-AllAllAll
Operating
System		NetappH700s Firmware-AllAllAll
Hardware Device InfoNetappHci Compute Node-AllAllAll
ApplicationNetappHci Management Node-AllAllAll
ApplicationNetappOntap Antivirus Connector-AllAllAll
ApplicationNetappOntap Select Deploy Administration Utility-AllAllAll
ApplicationNetappSantricity Smi-s Provider-AllAllAll
ApplicationNetappSmi-s Provider-AllAllAll
ApplicationNetappSnapmanager-AllAllAll
ApplicationNetappSolidfire-AllAllAll
ApplicationOpensslOpensslAllAllAllAll
ApplicationSiemensSinec InsAllAllAllAll
ApplicationSiemensSinec Ins1.0-AllAll
ApplicationSiemensSinec Ins1.0sp1AllAll
ApplicationSiemensSinec Ins1.0sp2AllAll
  • cpe:2.3:a:broadcom:sannav:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*:
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:fas_a400:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*:
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*:
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*:
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*:
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:*:
  • cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:*:
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:*:
  • cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:*:

Discovery Credit

Chancen (Qingteng 73lab)

Social Mentions

Source Title Posted (UTC)
Twitter Icon @iamamoose CVE-2022-2068 is another r_rehash script issue openssl.org/news/secadv/20… 2022-06-21 14:27:51
Twitter Icon @flano_yuki OpenSSL Security Advisory [21 June 2022] The c_rehash script allows command injection (CVE-2022-2068) Severity: M… twitter.com/i/web/status/1… 2022-06-21 14:39:49
Twitter Icon @CVEreport CVE-2022-2068 : In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstan… twitter.com/i/web/status/1… 2022-06-21 14:48:40
Twitter Icon @Robo_Alerts Potentially Critical CVE Detected! CVE-2022-2068 In addition to the c_rehash shell command injection identified in… twitter.com/i/web/status/1… 2022-06-21 15:56:01
Reddit Logo Icon /r/netcve CVE-2022-2068 2022-06-21 16:38:39
Reddit Logo Icon /r/googlecloudupdates March 21, 2023 GCP release notes 2023-03-22 01:00:07
Reddit Logo Icon /r/googlecloudupdates March 24, 2023 GCP release notes 2023-03-25 01:00:08
Reddit Logo Icon /r/synology DSM Version: 7.2-64561 2023-05-22 03:16:44
© CVE.report 2023 Twitter Nitter Twitter Viewer |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report