CVE-2022-1292
HighPublic exploitopenssl - security update
Published Aug 31, 2022 · Updated Oct 16, 2026 · Also known as ALPINE-CVE-2022-1292, DEBIAN-CVE-2022-1292, DLA-3008-1, DSA-5139-1, EUVD-2022-24621, GHSA-qjmp-vmxc-7p8r, JLSEC-2026-228, SUSE-SU-2022:2068-1, SUSE-SU-2022:2075-1, SUSE-SU-2022:2098-1, SUSE-SU-2022:2106-1, SUSE-SU-2022:2182-1, SUSE-SU-2022:2197-1, SUSE-SU-2022:2251-1, SUSE-SU-2022:2306-1, SUSE-SU-2022:2308-1, SUSE-SU-2022:2321-1, UBUNTU-CVE-2022-1292, USN-5402-1, USN-5402-2
Key Facts
Patch immediately- CVE-2022-1292 is a high-severity vulnerability (CVSS 7.3 v3.1) affecting Active Iq Unified Manager (Netapp), Clustered Data Ontap (Netapp), Clustered Data Ontap Antivirus Connector (Netapp) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. Public exploit code is available.
- EPSS estimates a 83% probability of exploitation in the next 30 days.
- Fixed versions are available, including compat-openssl098 0.9.8j-106.36.1, edk2 0~20160408.ffea0a2c-2ubuntu0.2+esm3, edk2 20240223gitedc6681206c1-1.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
7.3
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
83%
Higher than 99.6% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2022-1292 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
Affected Products
609 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| Active Iq Unified ManagerNetapp | See advisory | n/a |
| Clustered Data OntapNetapp | See advisory | n/a |
| Clustered Data Ontap Antivirus ConnectorNetapp | See advisory | n/a |
| Oncommand InsightNetapp | See advisory | n/a |
| Oncommand Workflow AutomationNetapp | See advisory | n/a |
Patched Releases
compat-openssl098
0.9.8j-106.36.1
edk2
0~20160408.ffea0a2c-2ubuntu0.2+esm3, 20240223gitedc6681206c1-1
edk2-aarch64
20200801stable-1.amzn2.0.5
edk2-ovmf
20200801stable-1.amzn2.0.5
edk2-tools
20200801stable-1.amzn2.0.5
edk2-tools-doc
20200801stable-1.amzn2.0.5
edk2-tools-python
20200801stable-1.amzn2.0.5
hvloader
1.0.1-2
jbcs-httpd24-openssl
1:1.1.1k-13.el7jbcs, 1:1.1.1k-13.el8jbcs
jws5-tomcat-native
0:1.2.31-11.redhat_11.el7jws, 0:1.2.31-11.redhat_11.el8jws, 0:1.2.31-11.redhat_11.el9jws
libopenssl-1_0_0-devel
1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl-1_0_0-devel-32bit
1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl-1_1-devel
1.1.0i-150000.4.69.1, 1.1.0i-150100.14.30.1, 1.1.1d-150200.11.48.1, 1.1.1d-2.66.1, 1.1.1l-150400.7.7.1, 1.1.1o-1.1
libopenssl-1_1-devel-32bit
1.1.0i-150100.14.30.1, 1.1.1d-150200.11.48.1, 1.1.1d-2.66.1, 1.1.1l-150400.7.7.1, 1.1.1o-1.1
libopenssl-3-devel
3.0.1-150400.4.7.1, 3.0.5-1.1
libopenssl-3-devel-32bit
3.0.1-150400.4.7.1, 3.0.5-1.1
libopenssl-devel
1.0.2j-60.80.1
libopenssl0_9_8
0.9.8j-106.36.1
libopenssl0_9_8-32bit
0.9.8j-106.36.1
libopenssl1_0_0
1.0.2j-60.80.1, 1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl1_0_0-32bit
1.0.2j-60.80.1, 1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl1_0_0-hmac
1.0.2j-60.80.1, 1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl1_0_0-hmac-32bit
1.0.2j-60.80.1, 1.0.2p-150000.3.56.1, 1.0.2p-3.53.1, 1.0.2u-9.1
libopenssl1_0_0-steam
1.0.2p-150000.3.56.1, 1.0.2u-9.1
libopenssl1_0_0-steam-32bit
1.0.2p-150000.3.56.1, 1.0.2u-9.1
Timeline
Publicly disclosed
Aug 31, 2022
Last updated
Oct 16, 2026
Weakness Type
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References
- advisoryhttp://access.redhat.com/errata/RHBA-2022:1352
- advisoryhttp://access.redhat.com/errata/RHSA-2022:5799
- advisoryhttp://access.redhat.com/errata/RHSA-2022:6024
- advisoryhttp://access.redhat.com/errata/RHSA-2022:6043
- advisoryhttp://access.redhat.com/errata/RHSA-2022:6224
FAQ
Common Questions.
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection.
Affected: Active Iq Unified Manager (Netapp); Clustered Data Ontap (Netapp); Clustered Data Ontap Antivirus Connector (Netapp), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
Public exploit code is available.
Fixed versions are available, including compat-openssl098 0.9.8j-106.36.1, edk2 0~20160408.ffea0a2c-2ubuntu0.2+esm3, edk2 20240223gitedc6681206c1-1.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2022-1292 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo