CVE-2022-1292 — CVE & Security Advisory Radar

🎯 CVE-2022-1292 CRITICAL 9.8 🔥 EPSS 82.6% 🇪🇺 EUVD

📄 .md Alle CVEs anzeigen ✕

CVE-2022-1292 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Klassifikation & Betroffenheit:

OpenSSL OpenSSL Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)OpenSSL Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)OpenSSL Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n)siemens brownfield_connectivity_gateway *openssl openssl *debian debian_linux 9.0debian debian_linux 10.0debian debian_linux 11.0

Improper Control of Generation of Code ('Code Injection') 🎯 Medium

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

🛡️ Empfohlene Mitigation: Refactor your program so that you do not have to dynamically generate code.

Vollständige Definition bei MITRE ➔

⚔️ Typische Angriffsmuster (CAPEC):

CAPEC-35 · Leverage Executable Code in Non-Executab… (Very High) CAPEC-77 · Manipulating User-Controlled Variables (Very High) CAPEC-242 · Code Injection (High)

🎯 ATT&CK-Techniken (Kill-Chain-Verhalten):

T1027.006 · Obfuscated Files or Information: H… T1027.009 · Obfuscated Files or Information: E… T1564.009 · Hide Artifacts: Resource Forking

🧩 Ähnliche Schwachstellen (Hersteller/Klasse/Score-Band):

CVE-2022-2068 9.8 CVE-2026-34182 9.1 CVE-2026-28386 9.1 CVE-2024-5535 9.1 CVE-2026-45447 8.8

🧪 Exploit-Evidenz:

🐙 li8u99/CVE-2022-1292 🐙 alcaparra/CVE-2022-1292 🐙 rama291041610/CVE-2022-1292 🐙 greek0x0/CVE-2022-1292 🐙 und3sc0n0c1d0/CVE-2022-1292

🩹 Patch verfügbar (OSV):

🩹 e818b74be2170fbe957a07b0da4401c2b694b3b8 (Commit) 🩹 e04bd3433fd84e1861bf258ea37928d9845e6a86 (Commit)

📚 Referenzen & Quellen:

🇪🇺 Original-Eintrag (ENISA EUVD) 🇺🇸 NVD-Eintrag

Ausnutzungs-Zeitleiste:

Reserviert 2022

Veröffentlicht 05/2022

Heute 03.09.

CVSS-Vektor-Analyse: 9.8

AV · Angriffsvektor Netzwerk

AC · Komplexität Gering

PR · Privilegien Keine

UI · Interaktion Keine

S · Scope Unverändert

C · Vertraulichkeit Hoch

I · Integrität Hoch

A · Verfügbarkeit Hoch

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Veröffentlicht:03.05.2022

Aktualisiert:17.06.2026 04:22

Assigner (CNA):openssl

EUVD-ID:EUVD-2022-24621

Quellen: 🇪🇺 EUVD-Datenbank (ENISA) + 🇺🇸 NVD-Anreicherung · 24-h-Cache

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

Tier	2026-08-29	2026-09-02
≥90 %	4	0
≥50 %	4	0
≥10 %	3	0
<10 %	304	300

9.8 CRITICAL

🇪🇺 EUVD

EPSS

82.6%

CVE-2022-1292 🌐 Netzwerk (Remote) 🔓 Keine Authentifizierung nötig

OpenSSL

CVE-2022-1292 | The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1

CWE-94: Code Injection ✓ Offizieller Patch / Advisory verfügbar

💡 Gegenmaßnahme: Sicherheits-Update des Herstellers zeitnah einspielen und Netzwerksegmentierung prüfen.

03.05.2022

🛡️ Details ➔

Zero-Day & Vulnerability Intelligence Hub