Amazon Linux 2 : openssl (ALAS-2022-1801)

The version of openssl installed on the remote host is prior to 1.0.2k-24. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2022-1801 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...

CVE-2022-1292 affecting package openssl for versions less than 1.1.1k-15

CVE-2022-1292 affecting package openssl for versions less than 1.1.1k-15. A patched version of the package is available...

CLSA-2022-1654011190 Fix CVE(s): CVE-2022-1473, CVE-2022-1292

SECURITY UPDATE: Improper Neutralization - debian/patches/CVE-2022-1292.patch: restrict using shell to invoke openssl due to possible privilege escalation - debian/patches/CVE-2022-1473.patch: fix bug OPENSSLLHflush memory releasing leading to DoS - CVE-2022-1292 - CVE-2022-1473...

Ubuntu 16.04 ESM : OpenSSL vulnerabilities (USN-5402-2)

The remote Ubuntu 16.04 ESM host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5402-2 advisory. USN-5402-1 fixed several vulnerabilities in OpenSSL. This update provides the corresponding update for Ubuntu 16.04 ESM. Tenable has extracted the...

CVE-2022-1292 affecting package openssl 1.1.1k-9

CVE-2022-1292 affecting package openssl 1.1.1k-9. A patched version of the package is available...

USN-5402-2: OpenSSL vulnerabilities

USN-5402-1 fixed several vulnerabilities in OpenSSL. This update provides the corresponding update for Ubuntu 16.04 ESM. Original advisory details: Elison Niven discovered that OpenSSL incorrectly handled the crehash script. A local attacker could possibly use this issue to execute arbitrary...

Security Bulletin: Vulnerability in OpenSSL affects IBM Spectrum Control (CVE-2022-1292)

Summary A vulnerability in OpenSSL could allow an attacker to execute arbitrary commands on the system. This vulnerability may affect IBM Spectrum Control due to its use of OpenSSL in the Storage Resource Agent component and XIV storage probe. Vulnerability Details CVEID:CVE-2022-1292 DESCRIPTION...

OESA-2022-1673 openssl security update

OpenSSL is a robust, commercial-grade, and full-featured toolkit for the Transport Layer Security TLS and Secure Sockets Layer SSL protocols. Security Fixes: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operati...

Exploit for OS Command Injection in Siemens Brownfield_Connectivity_Gateway

CVE-2022-1292 bash chack...

Debian DSA-5139-1 : openssl - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5139 advisory. Elison Niven discovered that the crehash script included in OpenSSL did not sanitise shell meta characters which could result in the execution of arbitrary commands...

[SECURITY] [DSA 5139-1] openssl security update

------------------------------------------------------------------------- Debian Security Advisory DSA-5139-1 [email protected] https://www.debian.org/security/ Moritz Muehlenhoff May 17, 2022 https://www.debian.org/security/faq -...

Ubuntu: Security Advisory (USN-5402-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] openssl

New openssl packages are available for Slackware 14.2, 15.0, and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/openssl-1.1.1o-i586-1slack15.0.txz: Upgraded. Fixed a bug in the crehash script which was not properly sanitising shell...

Slackware Linux 14.2 / 15.0 / current openssl Vulnerability (SSA:2022-124-02)

The version of openssl installed on the remote host is prior to 1.0.2u / 1.1.1o. It is, therefore, affected by a vulnerability as referenced in the SSA:2022-124-02 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distribut...

OpenSSL: c_rehash script allows command injection (CVE-2022-1292) - Windows

OpenSSL is prone to a command injection vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

OpenSSL: c_rehash script allows command injection (CVE-2022-1292) - Linux

OpenSSL is prone to a command injection vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

OpenSSL: Multiple Vulnerabilities (May 2022) - Windows

OpenSSL is prone to multiple vulnerabilities. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

OpenSSL 1.0.2 < 1.0.2ze Vulnerability

The version of OpenSSL installed on the remote host is prior to 1.0.2ze. It is, therefore, affected by a vulnerability as referenced in the 1.0.2ze advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some...

CVE-2022-1292

creationtimestamp| type| source ---|---|--- 2022-05-03 20:33:53+00:00| seen| https://t.me/cibsecurity/41824 2022-05-24 09:55:00+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/2279 2022-05-25 13:13:47+00:00| published-proof-of-concept|...

CVE-2022-1292

CVE-2022-1292 describes a command-injection risk in the OpenSSL c_rehash script due to improper sanitization of shell metacharacters. The issue can allow local attackers to run arbitrary commands with the script’s privileges on systems where c_rehash runs automatically. Fixes are published in Ope...