CVE-2022-2068: OpenSSL c_rehash script command injection via unsanitised filenames

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.3 and an EPSS probability above 0.95 with automatic execution on some systems make this a serious local command injection despite no KEV listing.

What it is

The OpenSSL c_rehash script fails to sanitise shell metacharacters in certificate filenames before passing them to shell commands, allowing OS command injection. This is a follow-up to CVE-2022-1292, where the initial fix missed other locations in the script with the same flaw. It matters because c_rehash is distributed by some operating systems in a manner where it is automatically executed, so an attacker who can place a crafted filename can run arbitrary commands with the script's privileges.

Impact

An attacker can execute arbitrary commands with the privileges of the account running c_rehash, which on some systems is automatic and potentially privileged. This yields full compromise of confidentiality, integrity and availability for that context.

Attack surface

Reached locally by supplying a certificate file whose name contains shell metacharacters to the c_rehash script; the CVSS vector requires local access, low privileges and user interaction. No remote network vector is described.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is very high at 0.954 (99.9th percentile), indicating strong predicted exploitation activity; references are patches and vendor advisories only, with no public exploit tag.

What to do

• Upgrade OpenSSL to 3.0.4, 1.1.1p or 1.0.2zf as applicable to your branch.
• Stop using the c_rehash script and replace it with the OpenSSL rehash command line tool.
• Where c_rehash must remain, ensure it is not invoked automatically and restrict who can write filenames into directories it processes.
• Apply vendor advisories for Debian, Fedora, Siemens, NetApp and Broadcom products that bundle affected OpenSSL versions.
• Audit scripts and cron jobs that call c_rehash and remove or sandbox them.

Detection

• Search filesystems for certificate files whose names contain shell metacharacters such as semicolons, backticks, pipes or dollar signs in directories processed by c_rehash.
• Monitor process trees for shell children spawned by c_rehash or rehash invocations.
• Alert on unexpected command execution from accounts or services that run c_rehash automatically.
• Check installed OpenSSL versions against the fixed releases 3.0.4, 1.1.1p and 1.0.2zf.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.