IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
9.8Kritisch

CVE-2022-1292The c_rehash script allows command injection

OpenSSL OpenSSL; Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP; Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP; Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem Veröffentlicht: (vor 4 Jahren)

Beschreibung

The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

Schwachstellentyp (CWE): CWE-78

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
debian debian linux 9.0
fedoraproject fedora 35
netapp a250 firmware —
netapp a700s firmware —
netapp active iq unified manager —
netapp aff 500f firmware —
netapp aff 8300 firmware —
netapp aff 8700 firmware —
netapp aff a400 firmware —
netapp clustered data ontap —
netapp clustered data ontap antivirus connector —
netapp fabric-attached storage a400 firmware —
netapp fas 500f firmware —
netapp fas 8300 firmware —
netapp fas 8700 firmware —
netapp h300e firmware —
netapp h300s firmware —
netapp h410s firmware —
netapp h500e firmware —
netapp h500s firmware —
netapp h700e firmware —
netapp h700s firmware —
netapp oncommand insight —
netapp oncommand workflow automation —
netapp santricity smi-s provider —
netapp smi-s provider —
netapp snapcenter —
netapp snapmanager —
netapp solidfire, enterprise sds & hci storage node —
netapp solidfire & hci management node —
OpenSSL OpenSSL Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2), Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n), Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd)
oracle enterprise manager ops center 12.4.0.0
oracle mysql server 5.0.0 – ≤ 5.7.38
oracle mysql workbench ≤ 8.0.29
siemens brownfield connectivity gateway < 2.15
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.0 – < V3.1.5
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem < V1.1
Siemens SINAMICS PERFECT HARMONY GH180 0
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.0 – < V3.1.5

Referenzen und Patches

CPE-Treffer (NVD) (43)
  • cpe:2.3:a:siemens:brownfield_connectivity_gateway:*:*:*:*:*:*:*:* < 2.15
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.0.2 < 1.0.2ze
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 1.1.1 < 1.1.1o
  • cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.3
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
  • cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
  • cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
  • cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
  • cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
  • cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* ≥ 5.0.0 ≤ 5.7.38
  • cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* ≥ 8.0.0 ≤ 8.0.29
  • cpe:2.3:a:oracle:mysql_workbench:*:*:*:*:*:*:*:* ≤ 8.0.29
  • cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
  • cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

Neue CVEs im selben Produkt — Debian

9.2Kritisch
CVE-2026-111497 KEV

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Calibre; Siemens Calibre ICE; Siemens Capital

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS
8.4Hoch
CVE-2026-77118

Out-of-bounds write in GraphicsMagick PCD decoder

GraphicsMagick Group GraphicsMagick; Debian graphicsmagick; Fedora Project GraphicsMagick

A heap out-of-bounds write exists in the Photo CD (PCD) decoder of GraphicsMagick. In DecodeImage() (coders/pcd.c), the Huffman delta loop advances its output pointer with q++ after every decoded delta and never checks it against the end of the heap-allocated…

6.0Mittel
CVE-2026-12996
OpenVPN OpenVPN

A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry

3.7Niedrig
CVE-2026-56968
GNU GNU SASL

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

7.5Hoch
CVE-2026-49975

Apache HTTP Server: mod_http2 denial of service

Apache Software Foundation Apache HTTP Server; Red Hat JBoss Core Services for RHEL 8; Red Hat JBoss Core Services on RHEL 7; Red Hat Red Hat Enterprise Linux 10

Memory Allocation with Excessive Size Value vulnerability in Apache HTTP Server's mod_http leads to denial of service via malicious HTTP requests. This issue affects Apache HTTP Server: from 2.4.17 through 2.4.67.

33%EPSS