CVE-2022-1292 @ Janus
Status
new
Priority
2.59
Match score
4.0
Risk
RCE
priv:user
CVSS
7.3 HIGH
Reason
cpe: openssl; pkgs: openssl; version: in-range: openssl-1.1.1n-0+deb10u6; risk:rce
Created
2026-10-15T10:20:34Z
Updated
2026-10-20T10:18:43Z
Package interrogation (copy)
Run on the host — click to copy a command. Debian/apt
| Package | Commands |
|---|---|
| openssl-1.1.1n-0+deb10u6 |
Inventory lookup
Search package inventory across systems, then return here. Create a ticket on systems the matcher missed.
Suggestions: openssl
| System | Matches | Ticket for CVE-2022-1292 | |
|---|---|---|---|
| Archive | libxmlsec1-openssl 1.2.27-2; openssl 1.1.1n-0+deb10u6 | new open | |
| Janus | openssl 1.1.1n-0+deb10u6 | new open | |
| Saiph | libgnutls-openssl27 3.6.7-4+deb10u12; libxmlsec1-openssl 1.2.27-2; openssl 1.1.1n-0+deb10u6 | new open | |
| morris | alt-openssl 1.0.2u; alt-openssl-libs 1.0.2u; alt-openssl11 1.1.1w; alt-openssl11-libs 1.1.1w; alt-python27-pyOpenSSL 0.10; alt-python37-pyOpenSSL 17.3.0; cpanel-perl-536-crypt-openssl-bignum 0.09; cpanel-perl-536-crypt-openssl-dsa 0.20 (+16 more) | new open | |
| mufasa | alt-openssl 1.0.2u; alt-openssl-libs 1.0.2u; alt-openssl11 1.1.1w; alt-openssl11-libs 1.1.1w; alt-python37-pyOpenSSL 17.3.0; cpanel-perl-536-crypt-openssl-bignum 0.09; cpanel-perl-536-crypt-openssl-dsa 0.20; cpanel-perl-536-crypt-openssl-ec 1.32 (+11 more) | new open | |
| Bullseye | libxmlsec1-openssl 1.2.31-1; openssl 1.1.1w-0+deb11u8 | none | |
| Helios | openssl 1.1.1w-0+deb11u8 | none | |
| Library | libgnutls-openssl27 3.5.8-5+deb9u6; openssl 1.1.0l-1~deb9u6 | none | |
| Matrix | libxmlsec1-openssl 1.2.37-2; openssl 3.0.22-1~deb12u1; perl-openssl-defaults 7+b1 | none | |
| Silk | alt-openssl 1.1.1w-3.5; alt-openssl-libs 1.1.1w-3.5; alt-openssl11-libs 1.1.1w-3.11; imunify360-webshield-openssl 3.5.6-2; libxmlsec1-openssl 1.2.37-2; openssl 3.0.22-1~deb12u1; perl-openssl-defaults 7+b1; python3-openssl 23.0.0-1 | none |
Same product CVEs in your queue
Other open tickets that look like the same product. Closed tickets are omitted unless they are already pegged to this CVE.
| CVE | CVSS | KEV | Systems | Status | Matched | Already related | |
|---|---|---|---|---|---|---|---|
| CVE-2021-20232 | 9.8 | Saiph | new | openssl | — | ||
| CVE-2021-20231 | 9.8 | Saiph | new | openssl | — | ||
| CVE-2023-4807 | 7.8 | Archive, Janus, Saiph | new | openssl | — | ||
| CVE-2022-0778 | 7.5 | Library, morris, mufasa | new | openssl | — | ||
| CVE-2023-0215 | 7.5 | Archive, Janus, Saiph, morris, mufasa | new | openssl | — | ||
| CVE-2023-0464 | 7.5 | Archive, Janus, Saiph, morris, mufasa | new | openssl | — | ||
| CVE-2024-0553 | 7.5 | Library, Saiph | new | openssl | — | ||
| CVE-2020-24659 | 7.5 | Library, Saiph | new | openssl | — | ||
| CVE-2022-2509 | 7.5 | Library, Saiph | new | openssl | — | ||
| CVE-2022-4450 | 7.5 | Archive, Janus, Saiph | new | openssl | — | ||
| CVE-2023-0286 | 7.4 | Archive, Janus, Saiph, morris, mufasa | new | openssl | — | ||
| CVE-2020-13777 | 7.4 | Saiph | new | openssl | — | ||
| CVE-2022-2068 | 7.3 | Archive, Janus, Saiph, morris, mufasa | new | openssl | — |
Related CVE (same fix)
Point this ticket’s CVE at a higher-priority / same-fix primary so you only triage one.
Host OS / kernel
OS
Debian GNU/Linux 10 (buster)
(10)
· debian
Arch
x86_64
kernel_release
uname -r → 4.19.0-27-amd64kernel_version
uname -v → #1 SMP Debian 4.19.316-1 (2024-06-25)For Linux kernel CVEs, kernel_version (Debian packaging / build string) often decides fixed vs not; kernel_release is used for upstream NVD range compares.
Same CVE on other hosts
Open the ticket for this CVE on another system.
| System | Status | Priority | Updated | |
|---|---|---|---|---|
| morris | new | 8.8 | 2026-10-20T10:18:43Z | Open |
| mufasa | new | 8.8 | 2026-10-20T10:18:43Z | Open |
| Archive | new | 2.59 | 2026-10-20T10:18:43Z | Open |
| Saiph | new | 2.59 | 2026-10-20T10:18:43Z | Open |
Description
The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).
Update status
Add note only
References
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=1ad73b4d27bd8c1b369a3cd453681d3a4f1bb9b2
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=548d3f280a6e737673f5b61fce24bb100108dfeb
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=e5fd1728ef4c7a5bf7c7a7163ca60370460a6e23
- https://lists.debian.org/debian-lts-announce/2022/05/msg00019.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VX4KWHPMKYJL6ZLW4M5IU7E5UV5ZWJQU/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZNU5M7BXMML26G3GPYKFGQYPQDRSNKDD/
- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2022-0011
- https://security.gentoo.org/glsa/202210-02
- https://security.netapp.com/advisory/ntap-20220602-0009/
- https://security.netapp.com/advisory/ntap-20220729-0004/
- https://www.debian.org/security/2022/dsa-5139
- https://www.openssl.org/news/secadv/20220503.txt
- https://www.oracle.com/security-alerts/cpujul2022.html
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
NVD: CVE-2022-1292