CVE-2022-2068 — openssl
CRITICALCVE-2022-2068 is a critical-severity (CVSS 9.8) OS Command Injection vulnerability. EPSS puts its 30-day exploitation probability at 96.4% (100th percentile). A fix is available — see the affected versions and patch details below.
The c_rehash script allows command injection
Exploitation Status
No confirmed exploitation observed yet
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
- A successful exploit gives an attacker total control of the affected component, not partial access.
- CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.
Exploitation and automatability from CISA’s SSVC triage for CVE-2022-2068.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
CVE-2022-2068 by exploitation likelihood (EPSS) against impact (CVSS). In the shaded patch-first corner (EPSS 50%+, CVSS 7.0+).
Where this sits among everything scored
Of 397,508 CVEs with a current EPSS score, this one falls in the ≥ 90% band (highlighted). Counts from FIRST.org, log-scaled.
Description
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
Affected Products
sannavbroadcomdebian linuxdebianfedorafedoraprojectaff 8300 firmwarenetappaff 8700 firmwarenetappaff a400 firmwarenetappDetection & mitigation playbook
VulnerabilityDetect
Identify every host running the affected component and compare the installed build against the fixed version below — for source-built or distro-packaged software the version string, not a lockfile, is the source of truth (`dpkg -l`, `rpm -q`, or the binary's own `--version`).
Fix
Upgrade the affected component to the fixed release for CVE-2022-2068, or apply your distribution's backported patch — distro builds are often patched at an older version number, so check your vendor's advisory rather than the upstream version alone.
Workarounds
Stop passing untrusted input into the interpreter or shell: call the affected binary with an argument array rather than a composed command string, reject anything outside a strict allowlist of expected values, and run the component under an account that cannot reach beyond the work it legitimately does.
Fixing This On Your OS
If you run this on a Linux distribution, patch through your package manager against the distro's own security advisory below — it tracks the exact backported fix for your release, which can ship on a different timeline (and sometimes a different severity) than the upstream project.
Red Hat Enterprise Linux uses a system-wide store of trusted certificates bundled in a single file and updated via `update-ca-trust`. The `c_rehash` script is not included in the default installation on any supported RHEL version and is never executed automatically. For these reasons, this flaw has been rated as…
As mentioned in the upstream security advisory, use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command-line tool.Source: Red Hat security advisory for CVE-2022-2068 (CC BY 4.0)
| Product | Fixed in | Advisory |
|---|---|---|
| JBoss Core Services for RHEL 8 | jbcs-httpd24-openssl-1:1.1.1k-13.el8jbcs | RHSA-2022:8840 |
| JWS 5.7.1 release | openssl | RHSA-2022:8913 |
| Red Hat Enterprise Linux 8 | openssl-1:1.1.1k-7.el8_6 | RHSA-2022:5818 |
| Red Hat Enterprise Linux 9 | openssl-1:3.0.1-41.el9_0 | RHSA-2022:6224 |
| Red Hat JBoss Core Services | see advisory | RHSA-2022:8841 |
| Red Hat JBoss Web Server 5.7 on RHEL 7 | jws5-tomcat-native-0:1.2.31-11.redhat_11.el7jws | RHSA-2022:8917 |
| Red Hat Satellite 6.11 for RHEL 7 | puppet-agent-0:7.26.0-3.el7sat | RHSA-2023:5980 |
| Red Hat Satellite 6.12 for RHEL 8 | puppet-agent-0:7.26.0-3.el8sat | RHSA-2023:5979 |
Frequently Asked Questions
Is CVE-2022-2068 in your dependencies?
Find it across , including transitive dependencies.