The c_rehash script allows command injection
Priority CRITICAL 90CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 19 fixed, 7 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.82612 99th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 19 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2); Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n); Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd) | — | No fix listed | CNA |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2); Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n); Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd) Fixed in — No fix listed CNA
CPE configurations NVD · 57
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:siemens:brownfield_connectivity_gateway:*:*:*:*:*:*:*:* | before 2.15 | Vulnerable | Siemens |
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 1.0.2 to before 1.0.2ze; 1.1.1 to before 1.1.1o; 3.0.0 to before 3.0.3 | Vulnerable | OpenSSL |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:siemens:brownfield_connectivity_gateway:*:*:*:*:*:*:*:* Versions before 2.15 Vulnerable ·Siemens
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2ze; 1.1.1 to before 1.1.1o; 3.0.0 to before 3.0.3 Vulnerable ·OpenSSL
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 47 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* | 5.0.0 – 5.7.38; 8.0.0 – 8.0.29 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* | up to 8.0.29 | Vulnerable | Oracle |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
- cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* Versions 5.0.0 – 5.7.38; 8.0.0 – 8.0.29 Vulnerable ·Oracle
- cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* Versions up to 8.0.29 Vulnerable ·Oracle
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
Remediation
Red Hat 11 advisories
- RHSA-2023:6818 Released 2023-11-08 · Red Hat rating ImportantSatellite 6.14 security and bug fix update
- Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
- RHSA-2023:5982 Released 2023-10-20 · Red Hat rating ImportantRed Hat Satellite Client security and bug fix update
- Satellite Client 6 for RHEL 6 puppet-agent-7.26.0-3.el6sat
- Satellite Client 6 for RHEL 7 foreman_ygg_worker-0.2.2-1.el7sat, puppet-agent-7.26.0-3.el7sat, yggdrasil-0.2.3-1.el7sat
- Satellite Client 6 for RHEL 8 foreman_ygg_worker-0.2.2-1.el8sat, puppet-agent-7.26.0-3.el8sat, yggdrasil-0.2.3-1.el8sat
- Satellite Client 6 for RHEL 9 foreman_ygg_worker-0.2.2-1.el9sat, puppet-agent-7.26.0-3.el9sat, yggdrasil-0.2.3-1.el9sat
- RHSA-2023:5980 Released 2023-10-20 · Red Hat rating ImportantSatellite 6.11.5.6 async security update
- Red Hat Satellite 6.11 for RHEL 7 foreman-3.1.1.27-1.el7sat, foreman-cli-3.1.1.27-1.el7sat, foreman-debug-3.1.1.27-1.el7sat +14
- Red Hat Satellite 6.11 for RHEL 8 foreman-3.1.1.27-1.el8sat, foreman-cli-3.1.1.27-1.el8sat, foreman-debug-3.1.1.27-1.el8sat +14
Show 8 more Red Hat advisories
- RHSA-2023:5979 Released 2023-10-20 · Red Hat rating ImportantSatellite 6.12.5.2 Async Security Update
- Red Hat Satellite 6.12 for RHEL 8 foreman-3.3.0.23-1.el8sat, puppet-agent-7.26.0-3.el8sat, rubygem-git-1.18.0-1.el8sat +2
- RHSA-2023:5931 Released 2023-10-19 · Red Hat rating ImportantSatellite 6.13.5 Async Security Update
- Red Hat Satellite 6.13 for RHEL 8 foreman-3.5.1.23-1.el8sat, foreman-cli-3.5.1.23-1.el8sat, foreman-debug-3.5.1.23-1.el8sat +17
- RHSA-2022:8917 Released 2022-12-12 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.1 release and security update
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native-1.2.31-11.redhat_11.el7jws
- Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native-1.2.31-11.redhat_11.el8jws
- Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native-1.2.31-11.redhat_11.el9jws
- RHSA-2022:8913 Released 2022-12-12 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.1 release and security update
- JWS 5.7.1 release
- RHSA-2022:8841 Released 2022-12-08 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services
- RHSA-2022:8840 Released 2022-12-08 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.86.0-2.el7jbcs, jbcs-httpd24-httpd-2.4.51-37.el7jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el7jbcs +15
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-7.86.0-2.el8jbcs, jbcs-httpd24-httpd-2.4.51-37.el8jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el8jbcs +15
- RHSA-2022:6224 Released 2022-08-30 · Red Hat rating Moderateopenssl security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-41.el9_0, openssl-perl-1:3.0.1-41.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-41.el9_0, openssl-libs-1:3.0.1-41.el9_0
- RHSA-2022:5818 Released 2022-08-03 · Red Hat rating Moderateopenssl security update
- Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-7.el8_6, openssl-devel-1:1.1.1k-7.el8_6, openssl-libs-1:1.1.1k-7.el8_6 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat Virtualization 4 | Affected | No fix yet: Fix deferred |
| JWS 5.7.1 release | Fixed | RHSA-2022:8913 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:5818 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat JBoss Core Services | Fixed | RHSA-2022:8841 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2022:8840 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2022:8840 |
| Red Hat JBoss Web Server 5.7 for RHEL 7 Server | Fixed | RHSA-2022:8917 |
| Red Hat JBoss Web Server 5.7 for RHEL 8 | Fixed | RHSA-2022:8917 |
| Red Hat JBoss Web Server 5.7 for RHEL 9 | Fixed | RHSA-2022:8917 |
| Red Hat Satellite 6.11 for RHEL 7 | Fixed | RHSA-2023:5980 |
| Red Hat Satellite 6.11 for RHEL 8 | Fixed | RHSA-2023:5980 |
| Red Hat Satellite 6.12 for RHEL 8 | Fixed | RHSA-2023:5979 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:5931 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2023:6818 |
| Satellite Client 6 for RHEL 6 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 7 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 8 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 9 | Fixed | RHSA-2023:5982 |
Not affected: 13 products
- Red Hat Advanced Cluster Management for Kubernetes 2
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
- Red Hat Satellite 6.11 for RHEL 7
- Red Hat Satellite 6.11 for RHEL 8
- Red Hat Satellite 6.12 for RHEL 8
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat Satellite 6.14 for RHEL 8
- Satellite Client 6 for RHEL 7
- Satellite Client 6 for RHEL 8
- Satellite Client 6 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1292
- 2026-10-03 Alias added: GHSA-qjmp-vmxc-7p8r
- 2026-10-09 Fix available: RHSA-2022:8841 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
- 2026-11-03 CISA SSVC decision points changed
References
Advisory 11
- https://www.openssl.org/news/secadv/20220503.txt
- [debian-lts-announce] 20220515 [SECURITY] [DLA 3008-1] openssl security update
- DSA-5139
- FEDORA-2022-b651cb69e6
- FEDORA-2022-c9c02865f6
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://security.netapp.com/advisory/ntap-20220602-0009/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011
- https://security.netapp.com/advisory/ntap-20220729-0004/
- GLSA-202210-02
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
Other 3
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
- TI-2003-00513 Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-1292 · CVE Program
- CVE-2022-1292 · NVD
- FIRST EPSS
- GHSA-qjmp-vmxc-7p8r · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1292 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences