CVE-2022-2068 - CVE House
Back to Database
Status published Unknown CVE-2022-2068

The c_rehash script allows command injection

Vulnerability Description

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-2068

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Chancen (Qingteng 73lab)

References

More from OpenSSL

View All →
CVE-2025-9232
Out-of-bounds read in HTTP client no_proxy handling
Unknown 0
CVE-2025-9231
Timing side-channel in SM2 algorithm on 64 bit ARM
Unknown 0
CVE-2025-9230
Out-of-bounds read & write in RFC 3211 KEK Unwrap
Unknown 0
CVE-2025-69421
NULL Pointer Dereference in PKCS12_item_decrypt_d2i_ex function
Unknown 0
CVE-2025-69420
Missing ASN1_TYPE validation in TS_RESP_verify_response() function
Unknown 0

Affected Vendor

Affected Software

OpenSSL
Vulnerable Versions:
Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3), Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o), Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze)

Timeline

Official Publish: June 21st, 2022
Last Modified: December 30th, 2025
Added to House: July 21st, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.