[SECURITY] [DLA 3008-1] openssl security update

2022-05-1502:10:14

lists.debian.org

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.106 Low

EPSS

Percentile

95.0%

JSON

Debian LTS Advisory DLA-3008-1 [email protected]
https://www.debian.org/lts/security/ Stefano Rivera
May 14, 2022 https://wiki.debian.org/LTS

Package : openssl
Version : 1.1.0l-1~deb9u6
CVE ID : CVE-2022-1292

The c_rehash script does not properly sanitise shell metacharacters to prevent
command injection. This script is executed by update-ca-certificates, from
ca-certificates, to re-hash certificates in /etc/ssl/certs/. An attacker able
to place files in this directory could execute arbitrary commands with the
privileges of the script.

For Debian 9 stretch, this problem has been fixed in version
1.1.0l-1~deb9u6.

We recommend that you upgrade your openssl packages.

For the detailed security status of openssl please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/openssl

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature

OSVersionArchitecturePackageVersionFilename
Debian11arm64openssl< 1.1.1n-0+deb11u2openssl_1.1.1n-0+deb11u2_arm64.deb
Debian10amd64libssl1.1-udeb< 1.1.1n-0+deb10u2libssl1.1-udeb_1.1.1n-0+deb10u2_amd64.deb
Debian11ppc64ellibssl1.1-udeb< 1.1.1n-0+deb11u2libssl1.1-udeb_1.1.1n-0+deb11u2_ppc64el.deb
Debian10mipsellibssl-dev< 1.1.1n-0+deb10u2libssl-dev_1.1.1n-0+deb10u2_mipsel.deb
Debian11ppc64ellibssl1.1-dbgsym< 1.1.1n-0+deb11u2libssl1.1-dbgsym_1.1.1n-0+deb11u2_ppc64el.deb
Debian10mips64ellibssl1.1< 1.1.1n-0+deb10u2libssl1.1_1.1.1n-0+deb10u2_mips64el.deb
Debian11i386openssl< 1.1.1n-0+deb11u2openssl_1.1.1n-0+deb11u2_i386.deb
Debian11armelopenssl-dbgsym< 1.1.1n-0+deb11u2openssl-dbgsym_1.1.1n-0+deb11u2_armel.deb
Debian11ppc64ellibcrypto1.1-udeb< 1.1.1n-0+deb11u2libcrypto1.1-udeb_1.1.1n-0+deb11u2_ppc64el.deb
Debian10mips64elopenssl< 1.1.1n-0+deb10u2openssl_1.1.1n-0+deb10u2_mips64el.deb

OS	Version	Architecture	Package	Version	Filename
Debian	11	arm64	openssl	< 1.1.1n-0+deb11u2	openssl_1.1.1n-0+deb11u2_arm64.deb
Debian	10	amd64	libssl1.1-udeb	< 1.1.1n-0+deb10u2	libssl1.1-udeb_1.1.1n-0+deb10u2_amd64.deb
Debian	11	ppc64el	libssl1.1-udeb	< 1.1.1n-0+deb11u2	libssl1.1-udeb_1.1.1n-0+deb11u2_ppc64el.deb
Debian	10	mipsel	libssl-dev	< 1.1.1n-0+deb10u2	libssl-dev_1.1.1n-0+deb10u2_mipsel.deb
Debian	11	ppc64el	libssl1.1-dbgsym	< 1.1.1n-0+deb11u2	libssl1.1-dbgsym_1.1.1n-0+deb11u2_ppc64el.deb
Debian	10	mips64el	libssl1.1	< 1.1.1n-0+deb10u2	libssl1.1_1.1.1n-0+deb10u2_mips64el.deb
Debian	11	i386	openssl	< 1.1.1n-0+deb11u2	openssl_1.1.1n-0+deb11u2_i386.deb
Debian	11	armel	openssl-dbgsym	< 1.1.1n-0+deb11u2	openssl-dbgsym_1.1.1n-0+deb11u2_armel.deb
Debian	11	ppc64el	libcrypto1.1-udeb	< 1.1.1n-0+deb11u2	libcrypto1.1-udeb_1.1.1n-0+deb11u2_ppc64el.deb
Debian	10	mips64el	openssl	< 1.1.1n-0+deb10u2	openssl_1.1.1n-0+deb10u2_mips64el.deb