NetSight
IP …
high7.3

CVE-2022-1292

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.

Impact

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Affected products

VendorProductAffected versions
SiemensBrownfield Connectivity Gateway
before 2.15
OpensslOpenssl
from 1.0.2 before 1.0.2ze
from 1.1.1 before 1.1.1o
from 3.0.0 before 3.0.3
DebianDebian Linux
Versions 9.0, 10.0, 11.0
NetappActive Iq Unified Manager
All versions
NetappClustered Data Ontap
All versions
NetappClustered Data Ontap Antivirus Connector
All versions
NetappOncommand Insight
All versions
NetappOncommand Workflow Automation
All versions
NetappSantricity Smi-S Provider
All versions
NetappSmi-S Provider
All versions
NetappSnapcenter
All versions
NetappSnapmanager
All versions

Weakness classification

CWE-78

References