CVE-2022-1292: The c_rehash script allows command injection

Modified

AliasesALPINE-CVE-2022-1292MGASA-2022-0173SUSE-SU-2022:2068-1+12 more

Published 03-05-2022Last modified 14-10-2026

Vulnerability summary

CVE-2022-1292 is a high (CVSS 10.0) vulnerability in debian debian_linux. EPSS estimates a 82.61% chance of exploitation in the next 30 days, higher than 99.6% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 83% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

10.0/10

010

High · v2.0 (NVD)

EPSS score

82.61%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

03-05-2022
PublishedVulnerability first disclosed.
14-10-2026
Last modifiedVulnerability information updated.

Description

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

CVSS metrics

8 scores · 7 sources · 2 versions

v3.19.8v2.010.0

EPSS trend

Probability

82.61%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

No change 0.00 pp

From 82.61% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-78Improper Neutralization of Special Elements used in an OS CommandThe product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command before it is sent to a downstream component.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Netapp28 products

Suse24 products

openssl-1_0_0&distro=SUSE Linux Enterprise Server 12 SP4-LTSS< 1.0.2p-3.53.1
openssl-1_0_0&distro=SUSE Linux Enterprise Server 12 SP5< 1.0.2p-3.53.1
openssl-1_0_0&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP4< 1.0.2p-3.53.1
openssl-1_0_0&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5< 1.0.2p-3.53.1
openssl-1_0_0&distro=SUSE Linux Enterprise Software Development Kit 12 SP5< 1.0.2p-3.53.1

Show all 24

Ubuntu4 products

edk2< 0~20160408.ffea0a2c-2ubuntu0.2+esm3
nodejs< 12.22.9~dfsg-1ubuntu3.1
openssl< 1.0.1f-1ubuntu2.27+esm10 | < 1.0.2g-1ubuntu4.20+esm3 | < 1.0.2g-1ubuntu4.fips.4.20.3 | All versions (No fix recorded) | < 1.1.1-1ubuntu2.1~18.04.17 | < 1.1.1-1ubuntu2.fips.2.1~18.04.17 | < 1.1.1f-1ubuntu2.13 | < 1.1.1f-1ubuntu2.fips.13.1 | < 3.0.2-0ubuntu1.1
openssl1.0< 1.0.2n-1ubuntu5.9

Chainguard3 products

eco-dotnet-libssl-1.0All versions (No fix recorded)
eco-dotnet-libssl-1.0-ld-so-confAll versions (No fix recorded)
ruby-3.1All versions (No fix recorded)

Oracle3 products

enterprise_manager_ops_center12.4.0.0
mysql_server≥ 5.0.0, ≤ 5.7.38 | ≥ 8.0.0, ≤ 8.0.29
mysql_workbench≤ 8.0.29

Alpine2 products

openssl≥ 1.0.2 (No fix recorded)
openssl3All versions (No fix recorded)

Debian2 products

openssl< 1.1.1n-0+deb10u2 | < 1.1.1n-0+deb11u2 | < 1.1.0l-1~deb9u6 | < 1.1.1o-1
debian_linuxEOL9.0 | 10.0 | 11.0

Fedoraproject1 product

fedoraEOL35 | 36

Mageia1 product

openssl< 1.1.1o-1.mga8

Openssl1 product

opensslFixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) | Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n) | Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd) | ≥ 1.0.2, < 1.0.2ze | ≥ 1.1.1, < 1.1.1o | ≥ 3.0.0, < 3.0.3

Opensuse1 product