EulerOS Virtualization 2.10.1 : openssl (EulerOS-SA-2022-2118)

According to the versions of the openssl packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2022-1977)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating...

EulerOS 2.0 SP9 : openssl (EulerOS-SA-2022-2007)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating...

Amazon Linux AMI : openssl (ALAS-2022-1605)

The version of openssl installed on the remote host is prior to 1.0.2k-16.158. It is, therefore, affected by a vulnerability as referenced in the ALAS-2022-1605 advisory. The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by...

Medium: openssl

Issue Overview: The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the...

USN-5488-2 openssl vulnerability

USN-5488-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 16.04 ESM. Original advisory details: Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the crehash script. A local attacker could possibly use this issue to execute arbitrary...

USN-5488-2: OpenSSL vulnerability

USN-5488-1 fixed vulnerabilities in OpenSSL. This update provides the corresponding updates for Ubuntu 16.04 ESM. Original advisory details: Chancen and Daniel Fiala discovered that OpenSSL incorrectly handled the crehash script. A local attacker could possibly use this issue to execute arbitrary...

MGASA-2022-0246 Updated openssl packages fix security vulnerability

The crehash script allows command injection. CVE-2022-2068...

Updated openssl packages fix security vulnerability

The crehash script allows command injection. CVE-2022-2068...

SUSE SLES12 Security Update : openssl-1_0_0 (SUSE-SU-2022:2197-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:2197-1 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by so...

Slackware Linux 14.2 openssl Multiple Vulnerabilities (SSA:2022-179-03)

The version of openssl installed on the remote host is prior to 1.0.2u. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-179-03 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distribut...

SUSE SLES12 Security Update : openssl (SUSE-SU-2022:2180-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2180-1 advisory. - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not...

Debian DSA-5169-1 : openssl - security update

The remote Debian 10 / 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5169 advisory. - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell...

SUSE SLES15 Security Update : openssl (SUSE-SU-2022:2179-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2022:2179-1 advisory. - In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not...

OpenSSL: The c_rehash script allows command injection (CVE-2022-2068) - Windows

OpenSSL is prone to a command injection vulnerability. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you ca...

Slackware Linux 14.0 / 14.1 / 14.2 / 15.0 / current openssl Multiple Vulnerabilities (SSA:2022-174-01)

The version of openssl installed on the remote host is prior to 1.0.1u / 1.0.2u / 1.1.1p. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2022-174-01 advisory. - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This...

Command Injection

openssl is vulnerable to command injection. The vulnerability exists in crehash script which allows an attacker to inject and execute malicious commands...

CVE-2022-2068

A flaw was found in OpenSSL. The issue in CVE-2022-1292 did not find other places in the crehash script where it possibly passed the file names of certificates being hashed to a command executed through the shell. Some operating systems distribute this script in a manner where it is automatically...

EulerOS 2.0 SP8 : openssl (EulerOS-SA-2022-1943)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating...

CVE-2022-2068

In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there...