CVE-2022-2068

CVE-2022-2068 is a command injection vulnerability in the c_rehash script, affecting OpenSSL versions 3.0.0-3.0.3, 1.1.1-1.1.1o, and 1.0.2-1.0.2ze, as well as products from Broadcom, Debian, Fedora Project, NetApp, and Siemens. This vulnerability stems from inadequate sanitization of shell metacharacters in certificate filenames, allowing an attacker to execute arbitrary commands with the script's privileges, particularly on systems where c_rehash is automatically executed. The vulnerability has a CVSS score of 7.3 (HIGH), indicating a local attack vector with low complexity, requiring user interaction, and potentially leading to high impacts on confidentiality, integrity, and availability. Its FAUCET Risk Score is 95/100, and it is categorized under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). Currently, there is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. While there are only two community mentions and one media article, the EPSS score suggests a higher-than-average potential for exploitation compared to other CVEs.