Read the docs
Red Hat Security Advisory

RHSA-2022:6224

openssl security and bug fix update

Released 2022-08-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 5 records

TI-2022-01915 CVE-2022-2068 · GHSA-xjxr-x4h8-946x

The c_rehash script allows command injection

Priority CRITICAL 93

In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.96391 Published 2022-06-21 Partial fix CWE-78
TI-2022-01176 CVE-2022-1292 · GHSA-qjmp-vmxc-7p8r

The c_rehash script allows command injection

Priority CRITICAL 90

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.82612 Published 2022-05-03 Partial fix CWE-78
TI-2022-01347 CVE-2022-1473 · GHSA-g323-fr93-4j3c

Resource leakage when decoding certificates and keys

Priority MEDIUM 46

The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04678 Published 2022-05-03 Fixed in 300.0.6 CWE-459
TI-2022-01940 CVE-2022-2097 · GHSA-3wx7-46ch-7rq2

AES OCB fails to encrypt some bytes

Priority LOW 38

AES OCB mode for 32-bit x86 platforms using the AES-NI assembly optimised implementation will not encrypt the entirety of the data under some circumstances.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.04899 Published 2022-07-05 Partial fix · 111.22.0, 300.0.9 CWE-327