Skip to content
Fencer Vulns
critical 9.8

CVE-2022-2068 in the critical feed json

The c_rehash script allows command injection

published 2022-06-21 4 y ago modified 2026-11-04 5 d ago also EUVD-2022-34360 , GHSA-xjxr-x4h8-946x , JLSEC-2026-229

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
96.4%
EPSS 96.4% chance of exploitation in 30 days, percentile 99.8%
public exploits
0
none known

Summary

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Patch / fix

  • julia OpenSSL_jll 1.1.16+0
  • julia Openresty_jll 1.21.4+0
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem V1.1
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • openssl Debian 14, Debian 13, Debian 12 3.0.4-1

debian advisories DEBIAN-CVE-2022-2068

  • nodejs Ubuntu 22.04 LTS 12.22.9~dfsg-1ubuntu3.1
  • openssl Ubuntu 18.04 LTS 1.1.1-1ubuntu2.1~18.04.19
  • openssl Ubuntu 20.04 LTS 1.1.1f-1ubuntu2.15
  • openssl Ubuntu 22.04 LTS 3.0.2-0ubuntu1.5
  • openssl1.0 Ubuntu 18.04 LTS 1.0.2n-1ubuntu5.10
  • openssl Ubuntu Pro 14.04 LTS 1.0.1f-1ubuntu2.27+esm10
  • openssl Ubuntu Pro 16.04 LTS 1.0.2g-1ubuntu4.20+esm5
  • openssl Ubuntu Pro FIPS-updates 16.04 LTS 1.0.2g-1ubuntu4.fips.4.20.3

ubuntu advisories UBUNTU-CVE-2022-2068

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • foreman satellite utils 6.14, satellite capsule 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-cli satellite utils 6.14, satellite 6.14 3.7.0.9-1.el8sat
  • foreman-ec2 satellite 6.14 3.7.0.9-1.el8sat
  • rubygem-git satellite 6.14, satellite 6.13, satellite 6.12 1.18.0-1.el8sat
  • puppet-agent satellite capsule 6.14, satellite capsule 6.13, satellite capsule 6.12 +6 more 7.26.0-3.el8sat
  • puppetserver satellite capsule 6.14, satellite 6.14 7.11.0-1.el8sat
  • rubygem-rack satellite capsule 6.14, satellite 6.14 2.2.7-1.el8sat
  • foreman-ovirt satellite 6.14 3.7.0.9-1.el8sat

red hat advisories RHSA-2023:6818RHSA-2023:5982RHSA-2023:5980RHSA-2023:5979RHSA-2023:5931RHSA-2022:8917

  • openssl-1_0_0 SLES for SAP 15 SP2, SLES for SAP 15 SP1, SLES for SAP 15 +13 more 1.0.2p-150000.3.56.1
  • openssl-1_1 SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 1.1.0i-150000.4.74.1
  • openssl-1_1 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 1.1.1l-150400.7.7.1
  • openssl-3 SLE Module for Basesystem 15 SP4, openSUSE Leap 15.4 3.0.1-150400.4.7.1
  • openssl-1_1 SLES 15 SP2-BCL, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +11 more 1.1.1d-150200.11.48.1
  • compat-openssl098 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES for SAP 12 SP3 +1 more 0.9.8j-106.36.1
  • openssl-1_1 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.1.1d-2.66.1
  • openssl-1_0_0 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +4 more 1.0.2p-3.56.1

suse advisories SUSE-SU-2022:2321-1SUSE-SU-2022:2309-1SUSE-SU-2022:2308-1SUSE-SU-2022:2306-1SUSE-SU-2022:2251-2SUSE-SU-2022:2251-1

  • grype openSUSE Tumbleweed 0.92.1-1.1
  • openssl-1_1 openSUSE Tumbleweed 1.1.1p-1.1
  • openssl-1_0_0 openSUSE Tumbleweed 1.0.2u-9.1

opensuse advisories openSUSE-SU-2025:15136-1openSUSE-SU-2024:12159-1openSUSE-SU-2024:12178-1

  • openssl AlmaLinux 9 1:3.0.1-41.el9_0
  • openssl-libs AlmaLinux 9 1:3.0.1-41.el9_0
  • openssl-perl AlmaLinux 9 1:3.0.1-41.el9_0
  • openssl AlmaLinux 8 1:1.1.1k-7.el8_6
  • openssl-libs AlmaLinux 8 1:1.1.1k-7.el8_6
  • openssl-perl AlmaLinux 8 1:1.1.1k-7.el8_6

almalinux advisories ALSA-2022:6224ALSA-2022:5818

  • openssl Rocky Linux 8 1:1.1.1k-7.el8_6

rocky linux advisories RLSA-2022:5818

  • openssl CBL-Mariner 2.0 1.1.1k-17

azure linux advisories AZL-9967

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-2068 updated cvss 6.7

openssl: the c_rehash script allows command injection

  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/management-ingress-rhel8 Red Hat Enterprise Linux 6 openssl, openssl098e, openssl-perl Red Hat Enterprise Linux 7 ovmf, OVMF, AAVMF, openssl, openssl098e, openssl-libs, +1 more Red Hat Enterprise Linux 8 compat-openssl10 Red Hat Enterprise Linux 9 compat-openssl11 Red Hat JBoss Enterprise Application Platform 6 openssl
    +1 more products
    Red Hat JBoss Web Server 3 openssl
    affected: workaround, no fix planned “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.”
  • Red Hat Virtualization 4 redhat-virtualization-host-image-update
    affected: workaround, no fix available “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.”
  • Red Hat JWS 5.7.1 release
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:8913
  • Red Hat Enterprise Linux AppStream (v. 9) openssl-perl 3.0.1-41.el9_0
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:6224
  • Red Hat Enterprise Linux BaseOS (v. 8) openssl 1.1.1k-7.el8_6, openssl-libs 1.1.1k-7.el8_6, openssl-perl 1.1.1k-7.el8_6
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:5818
  • Red Hat Enterprise Linux BaseOS (v. 9) openssl 3.0.1-41.el9_0, openssl-libs 3.0.1-41.el9_0
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:6224
  • Red Hat JBoss Core Services
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:8841
  • Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-openssl 1.1.1k-13.el7jbcs, jbcs-httpd24-openssl-libs 1.1.1k-13.el7jbcs, jbcs-httpd24-openssl-perl 1.1.1k-13.el7jbcs Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-openssl 1.1.1k-13.el8jbcs, jbcs-httpd24-openssl-libs 1.1.1k-13.el8jbcs, jbcs-httpd24-openssl-perl 1.1.1k-13.el8jbcs
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:8840
show 7 more
  • Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native 1.2.31-11.redhat_11.el7jws Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native 1.2.31-11.redhat_11.el8jws Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native 1.2.31-11.redhat_11.el9jws
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2022:8917
  • Red Hat Satellite 6.11 for RHEL 7 puppet-agent 7.26.0-3.el7sat Red Hat Satellite 6.11 for RHEL 8 puppet-agent 7.26.0-3.el8sat
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2023:5980
  • Red Hat Satellite 6.12 for RHEL 8 puppet-agent 7.26.0-3.el8sat
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2023:5979
  • Red Hat Satellite 6.13 for RHEL 8 puppet-agent 7.26.0-3.el8sat
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2023:5931
  • Red Hat Satellite 6.14 for RHEL 8 puppet-agent 7.26.0-3.el8sat
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2023:6818
  • Red Hat Satellite Client 6 for RHEL 6 puppet-agent 7.26.0-3.el6sat Red Hat Satellite Client 6 for RHEL 7 puppet-agent 7.26.0-3.el7sat Red Hat Satellite Client 6 for RHEL 8 puppet-agent 7.26.0-3.el8sat Red Hat Satellite Client 6 for RHEL 9 puppet-agent 7.26.0-3.el9sat
    fixed: vendor fix “As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.” RHSA-2023:5982
  • Red Hat Enterprise Linux 8 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, shim-ia32, +1 more Red Hat Enterprise Linux 9 edk2, shim, shim-x64, edk2-ovmf, shim-aa64, edk2-tools, +1 more Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl 7.86.0-2.el7jbcs, jbcs-httpd24-httpd 2.4.51-37.el7jbcs, jbcs-httpd24-mod_md 2.4.0-18.el7jbcs, jbcs-httpd24-libcurl 7.86.0-2.el7jbcs, jbcs-httpd24-apr-util 1.6.1-99.el7jbcs, jbcs-httpd24-mod_ssl 2.4.51-37.el7jbcs, +21 more Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl 7.86.0-2.el8jbcs, jbcs-httpd24-httpd 2.4.51-37.el8jbcs, jbcs-httpd24-mod_md 2.4.0-18.el8jbcs, jbcs-httpd24-libcurl 7.86.0-2.el8jbcs, jbcs-httpd24-apr-util 1.6.1-99.el8jbcs, jbcs-httpd24-mod_ssl 2.4.51-37.el8jbcs, +21 more Red Hat Satellite 6.11 for RHEL 7 foreman 3.1.1.27-1.el7sat, satellite 6.11.5.6-1.el7sat, foreman-cli 3.1.1.27-1.el7sat, foreman-ec2 3.1.1.27-1.el7sat, foreman-gce 3.1.1.27-1.el7sat, foreman-ovirt 3.1.1.27-1.el7sat, +15 more Red Hat Satellite 6.11 for RHEL 8 foreman 3.1.1.27-1.el8sat, satellite 6.11.5.6-1.el8sat, foreman-cli 3.1.1.27-1.el8sat, foreman-ec2 3.1.1.27-1.el8sat, foreman-gce 3.1.1.27-1.el8sat, rubygem-git 1.18.0-0.1.el8sat, +15 more
    +6 more products
    Red Hat Satellite 6.12 for RHEL 8 foreman 3.3.0.23-1.el8sat, rubygem-git 1.18.0-1.el8sat, satellite 6.12.5.2-1.el8sat, foreman-cli 3.3.0.23-1.el8sat, foreman-ec2 3.3.0.23-1.el8sat, foreman-gce 3.3.0.23-1.el8sat, +14 more Red Hat Satellite 6.13 for RHEL 8 foreman 3.5.1.23-1.el8sat, satellite 6.13.5-1.el8sat, rubygem-git 1.18.0-1.el8sat, python-django 3.2.21-1.el8pc, foreman-cli 3.5.1.23-1.el8sat, foreman-ec2 3.5.1.23-1.el8sat, +25 more Red Hat Satellite 6.14 for RHEL 8 cjson 1.7.14-5.el8sat, katello 4.9.0-1.el8sat, libsolv 0.7.22-4.el8pc, libcomps 0.1.18-4.el8pc, python-idna 3.3-2.el8pc, candlepin 4.3.1-1.el8sat, +668 more Red Hat Satellite Client 6 for RHEL 7 yggdrasil 0.2.3-1.el7sat, foreman_ygg_worker 0.2.2-1.el7sat Red Hat Satellite Client 6 for RHEL 8 qpid-proton 0.37.0-2.el8, yggdrasil 0.2.3-1.el8sat, qpid-proton-c 0.37.0-2.el8, python3-qpid-proton 0.37.0-2.el8, foreman_ygg_worker 0.2.2-1.el8sat Red Hat Satellite Client 6 for RHEL 9 qpid-proton 0.37.0-2.el9, yggdrasil 0.2.3-1.el9sat, qpid-proton-c 0.37.0-2.el9, python3-qpid-proton 0.37.0-2.el9, foreman_ygg_worker 0.2.2-1.el9sat
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 9.8

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-194-01 updated cvss 9.8

Siemens RUGGEDCOM ROX

  • Siemens RUGGEDCOM ROX MX5000 <V2.16.0 Siemens RUGGEDCOM ROX MX5000RE <V2.16.0 Siemens RUGGEDCOM ROX RX1400 <V2.16.0 Siemens RUGGEDCOM ROX RX1500 <V2.16.0 Siemens RUGGEDCOM ROX RX1501 <V2.16.0 Siemens RUGGEDCOM ROX RX1510 <V2.16.0
    +5 more products
    Siemens RUGGEDCOM ROX RX1511 <V2.16.0 Siemens RUGGEDCOM ROX RX1512 <V2.16.0 Siemens RUGGEDCOM ROX RX1524 <V2.16.0 Siemens RUGGEDCOM ROX RX1536 <V2.16.0 Siemens RUGGEDCOM ROX RX5000 <V2.16.0
    affected: fixed in V2.16.0 support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-23-166-11 updated cvss 9.8

Siemens SIMATIC S7-1500 TM MFP Linux Kernel

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-22-319-01 updated cvss 9.8

Mitsubishi Electric GT SoftGOT2000

  • Mitsubishi Electric GT SoftGOT2000 1.275M—1.280S
    affected: mitigation “Refer to the Mitsubishi Electric advisory for further details and instructions for determining installed versions.” mitsubishielectric.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
10 mo ago

Exploit prediction

96.39% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 2.0 10.0 AV:N/AC:L/Au:N/C:C/I:C/A:C
OSV 3.1 7.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
julia OpenSSL_jll
<1.1.16+0
1.1.16+0
julia Openresty_jll
<1.21.4+0
1.21.4+0

Affected products

  • OpenSSL OpenSSL
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.