The c_rehash script allows command injection
Priority CRITICAL 93CWE-78Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 19 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-78.
Summary
In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze).
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.96391 99th percentileScored 2026-11-07
Fix Partial Red Hat: 11 advisoriesRed Hat: 19 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3); Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o); Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze) | — | No fix listed | CNA |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3); Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o); Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze) Fixed in — No fix listed CNA
CPE configurations NVD · 48
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 1.0.2 to before 1.0.2zf; 1.1.1 to before 1.1.1p; 3.0.0 to before 3.0.4 | Vulnerable | OpenSSL |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* | 11.0 | Vulnerable | Debian |
| cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* | 35 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* | 36 | Vulnerable | Fedoraproject |
| cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* | before 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* | 1.0 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* | 1.0 sp1 | Vulnerable | Siemens |
| cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* | 1.0 sp2 | Vulnerable | Siemens |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 1.0.2 to before 1.0.2zf; 1.1.1 to before 1.1.1p; 3.0.0 to before 3.0.4 Vulnerable ·OpenSSL
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
- cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
- cpe:2.3:a:siemens:sinec_ins:*:*:*:*:*:*:*:* Versions before 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:-:*:*:*:*:*:* Versions 1.0 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:sp1:*:*:*:*:*:* Versions 1.0 sp1 Vulnerable ·Siemens
- cpe:2.3:a:siemens:sinec_ins:1.0:sp2:*:*:*:*:*:* Versions 1.0 sp2 Vulnerable ·Siemens
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 38 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:broadcom:sannav:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Broadcom |
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h615c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h610s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h610c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:broadcom:sannav:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom
Remediation
Red Hat 11 advisories
- RHSA-2023:6818 Released 2023-11-08 · Red Hat rating ImportantSatellite 6.14 security and bug fix update
- Red Hat Satellite 6.14 for RHEL 8 foreman-3.7.0.9-1.el8sat, foreman-cli-3.7.0.9-1.el8sat, foreman-debug-3.7.0.9-1.el8sat +33
- RHSA-2023:5982 Released 2023-10-20 · Red Hat rating ImportantRed Hat Satellite Client security and bug fix update
- Satellite Client 6 for RHEL 6 puppet-agent-7.26.0-3.el6sat
- Satellite Client 6 for RHEL 7 foreman_ygg_worker-0.2.2-1.el7sat, puppet-agent-7.26.0-3.el7sat, yggdrasil-0.2.3-1.el7sat
- Satellite Client 6 for RHEL 8 foreman_ygg_worker-0.2.2-1.el8sat, puppet-agent-7.26.0-3.el8sat, yggdrasil-0.2.3-1.el8sat
- Satellite Client 6 for RHEL 9 foreman_ygg_worker-0.2.2-1.el9sat, puppet-agent-7.26.0-3.el9sat, yggdrasil-0.2.3-1.el9sat
- RHSA-2023:5980 Released 2023-10-20 · Red Hat rating ImportantSatellite 6.11.5.6 async security update
- Red Hat Satellite 6.11 for RHEL 7 foreman-3.1.1.27-1.el7sat, foreman-cli-3.1.1.27-1.el7sat, foreman-debug-3.1.1.27-1.el7sat +14
- Red Hat Satellite 6.11 for RHEL 8 foreman-3.1.1.27-1.el8sat, foreman-cli-3.1.1.27-1.el8sat, foreman-debug-3.1.1.27-1.el8sat +14
Show 8 more Red Hat advisories
- RHSA-2023:5979 Released 2023-10-20 · Red Hat rating ImportantSatellite 6.12.5.2 Async Security Update
- Red Hat Satellite 6.12 for RHEL 8 foreman-3.3.0.23-1.el8sat, puppet-agent-7.26.0-3.el8sat, rubygem-git-1.18.0-1.el8sat +2
- RHSA-2023:5931 Released 2023-10-19 · Red Hat rating ImportantSatellite 6.13.5 Async Security Update
- Red Hat Satellite 6.13 for RHEL 8 foreman-3.5.1.23-1.el8sat, foreman-cli-3.5.1.23-1.el8sat, foreman-debug-3.5.1.23-1.el8sat +17
- RHSA-2022:8917 Released 2022-12-12 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.1 release and security update
- Red Hat JBoss Web Server 5.7 for RHEL 7 Server jws5-tomcat-native-1.2.31-11.redhat_11.el7jws
- Red Hat JBoss Web Server 5.7 for RHEL 8 jws5-tomcat-native-1.2.31-11.redhat_11.el8jws
- Red Hat JBoss Web Server 5.7 for RHEL 9 jws5-tomcat-native-1.2.31-11.redhat_11.el9jws
- RHSA-2022:8913 Released 2022-12-12 · Red Hat rating ModerateRed Hat JBoss Web Server 5.7.1 release and security update
- JWS 5.7.1 release
- RHSA-2022:8841 Released 2022-12-08 · Red Hat rating ImportantRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services
- RHSA-2022:8840 Released 2022-12-08 · Red Hat rating ModerateRed Hat JBoss Core Services Apache HTTP Server 2.4.51 SP1 security update
- Red Hat JBoss Core Services on RHEL 7 Server jbcs-httpd24-curl-7.86.0-2.el7jbcs, jbcs-httpd24-httpd-2.4.51-37.el7jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el7jbcs +15
- Red Hat JBoss Core Services on RHEL 8 jbcs-httpd24-curl-7.86.0-2.el8jbcs, jbcs-httpd24-httpd-2.4.51-37.el8jbcs, jbcs-httpd24-httpd-devel-2.4.51-37.el8jbcs +15
- RHSA-2022:6224 Released 2022-08-30 · Red Hat rating Moderateopenssl security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-41.el9_0, openssl-perl-1:3.0.1-41.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-41.el9_0, openssl-libs-1:3.0.1-41.el9_0
- RHSA-2022:5818 Released 2022-08-03 · Red Hat rating Moderateopenssl security update
- Red Hat Enterprise Linux BaseOS (v. 8) openssl-1:1.1.1k-7.el8_6, openssl-devel-1:1.1.1k-7.el8_6, openssl-libs-1:1.1.1k-7.el8_6 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 9 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Web Server 3 | Affected | No fix planned: Out of support scope |
| Red Hat Virtualization 4 | Affected | No fix yet: Fix deferred |
| JWS 5.7.1 release | Fixed | RHSA-2022:8913 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2022:5818 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat JBoss Core Services | Fixed | RHSA-2022:8841 |
| Red Hat JBoss Core Services on RHEL 7 Server | Fixed | RHSA-2022:8840 |
| Red Hat JBoss Core Services on RHEL 8 | Fixed | RHSA-2022:8840 |
| Red Hat JBoss Web Server 5.7 for RHEL 7 Server | Fixed | RHSA-2022:8917 |
| Red Hat JBoss Web Server 5.7 for RHEL 8 | Fixed | RHSA-2022:8917 |
| Red Hat JBoss Web Server 5.7 for RHEL 9 | Fixed | RHSA-2022:8917 |
| Red Hat Satellite 6.11 for RHEL 7 | Fixed | RHSA-2023:5980 |
| Red Hat Satellite 6.11 for RHEL 8 | Fixed | RHSA-2023:5980 |
| Red Hat Satellite 6.12 for RHEL 8 | Fixed | RHSA-2023:5979 |
| Red Hat Satellite 6.13 for RHEL 8 | Fixed | RHSA-2023:5931 |
| Red Hat Satellite 6.14 for RHEL 8 | Fixed | RHSA-2023:6818 |
| Satellite Client 6 for RHEL 6 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 7 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 8 | Fixed | RHSA-2023:5982 |
| Satellite Client 6 for RHEL 9 | Fixed | RHSA-2023:5982 |
Not affected: 12 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services on RHEL 7 Server
- Red Hat JBoss Core Services on RHEL 8
- Red Hat Satellite 6.11 for RHEL 7
- Red Hat Satellite 6.11 for RHEL 8
- Red Hat Satellite 6.12 for RHEL 8
- Red Hat Satellite 6.13 for RHEL 8
- Red Hat Satellite 6.14 for RHEL 8
- Satellite Client 6 for RHEL 7
- Satellite Client 6 for RHEL 8
- Satellite Client 6 for RHEL 9
Timeline
- 2026-10-02 Threatist record created from CVE-2022-2068
- 2026-10-03 Alias added: GHSA-xjxr-x4h8-946x
- 2026-10-09 Fix available: RHSA-2022:8841 · Red Hat
- 2026-10-16 Fix available: Red Hat JBoss Core Services · Red Hat
- 2026-11-03 CISA SSVC decision points changed
References
Patch 3
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2c9c35870601b4a44d86ddbf512b38df38285cfa
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=9639817dac8bbbaa64d09efad7464ccc405527c7
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=7a9c027159fe9e1bbc2cd38a8a2914bff0d5abd9
More Openssl vulnerabilities
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
- TI-2003-00513 Double free vulnerability in OpenSSL 0.9.7 allows remote attackers to cause a denial of… CVSS 3.1CRITICAL 9.8
Sources
- CVE-2022-2068 · CVE Program
- CVE-2022-2068 · NVD
- FIRST EPSS
- GHSA-xjxr-x4h8-946x · GitHub Advisory Database · CC BY 4.0
- CVE-2022-2068 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences