High · published May 3, 2022
CVSS calls it high at 7.3. It sits in the 99.7th percentile for exploit probability.
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
| Product | Versions | Fixed in |
|---|---|---|
| siemens/brownfield_connectivity_gateway | < 2.15 | 2.15 |
| openssl/openssl | ≥ 1.0.2, < 1.0.2ze | 1.0.2ze |
| openssl/openssl | ≥ 1.1.1, < 1.1.1o | 1.1.1o |
| openssl/openssl | ≥ 3.0.0, < 3.0.3 | 3.0.3 |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| debian/debian_linux | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/clustered_data_ontap | all versions | — |
| netapp/clustered_data_ontap_antivirus_connector | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/santricity_smi-s_provider | all versions | — |
| netapp/smi-s_provider | all versions | — |
| netapp/snapcenter | all versions | — |
| netapp/snapmanager | all versions | — |
| netapp/solidfire\,_enterprise_sds_\&_hci_storage_node | all versions | — |
| netapp/solidfire_\&_hci_management_node | all versions | — |
| netapp/a700s_firmware | all versions | — |
| netapp/h300s_firmware | all versions | — |
| netapp/h500s_firmware | all versions | — |
| netapp/h700s_firmware | all versions | — |
| netapp/h300e_firmware | all versions | — |
| netapp/h500e_firmware | all versions | — |
| netapp/h700e_firmware | all versions | — |
| netapp/h410s_firmware | all versions | — |
| netapp/aff_8300_firmware | all versions | — |
| netapp/fas_8300_firmware | all versions | — |
| netapp/aff_8700_firmware | all versions | — |
| netapp/fas_8700_firmware | all versions | — |
| netapp/aff_a400_firmware | all versions | — |
| netapp/fabric-attached_storage_a400_firmware | all versions | — |
| netapp/a250_firmware | all versions | — |
| netapp/aff_500f_firmware | all versions | — |
| netapp/fas_500f_firmware | all versions | — |
| oracle/enterprise_manager_ops_center | all versions | — |
| oracle/mysql_server | ≥ 5.0.0, ≤ 5.7.38 | — |
| oracle/mysql_server | ≥ 8.0.0, ≤ 8.0.29 | — |
| oracle/mysql_workbench | ≤ 8.0.29 | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |