CVE-2022-1292

The crehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the crehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd).

References

Affected packages

Git / github.com/mysql/mysql-server

Affected ranges

Type

GIT

Repo

https://github.com/mysql/mysql-server

Events

Introduced

Last affected

527c12ed611f3fe072c3043734319edb2c733099

Introduced

f9e2c6cd27268e72198bde3c1a71eb1273df335a

Last affected

c94ce787737f9a6c9a31abe22bee02866698885b

Introduced

270fd3411e3d671a73ed9725940a30080f59ce6d

Last affected

8d8c986e5716e38cb776b627a8eee9e92241b4ce

Introduced

Last affected

8d8c986e5716e38cb776b627a8eee9e92241b4ce

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "9.0"
        },
        {
            "introduced": "5.0.0"
        },
        {
            "last_affected": "5.7.38"
        },
        {
            "introduced": "8.0.0"
        },
        {
            "last_affected": "8.0.29"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0.29"
        }
    ]
}

Type

GIT

Repo

https://github.com/openssl/openssl

Events

Introduced

e818b74be2170fbe957a07b0da4401c2b694b3b8

Fixed

e818b74be2170fbe957a07b0da4401c2b694b3b8

Introduced

e04bd3433fd84e1861bf258ea37928d9845e6a86

Fixed

e04bd3433fd84e1861bf258ea37928d9845e6a86

Introduced

89cd17a031e022211684eb7eb41190cf1910f9fa

Fixed

4d346a188c27bdf78aa76590c641e1217732ca4b

Database specific

{
    "versions": [
        {
            "introduced": "1.0.2"
        },
        {
            "fixed": "1.0.2ze"
        },
        {
            "introduced": "1.1.1"
        },
        {
            "fixed": "1.1.1o"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.0.3"
        }
    ]
}

Affected versions

mysql-3.*

mysql-3.23.22-beta

mysql-3.23.28-gamma

mysql-3.23.30-gamma

mysql-3.23.31

mysql-3.23.32

mysql-3.23.33

mysql-3.23.36

mysql-4.*

mysql-4.0.2

mysql-4.0.4

mysql-5.*

mysql-5.1.4

mysql-5.7.31

mysql-5.7.32

mysql-5.7.35

mysql-5.7.36

mysql-5.7.37

mysql-5.7.38

mysql-8.*

mysql-8.0.29

mysql-9.*

mysql-9.0.0

mysql-9.0.0-release

mysql-cluster-8.*

mysql-cluster-8.0.29

mysql-cluster-9.*

mysql-cluster-9.0.0

openssl-3.*

openssl-3.0.0

openssl-3.0.1

openssl-3.0.2

Database specific

vanir_signatures

[
    {
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "28170854778703993674264004058177114599",
                "73132526844288570625317440636111911761",
                "177405411499435185068645597737938634778",
                "224809958623850711330610094965797758930",
                "295554444428855106393106961197201359586"
            ],
            "threshold": 0.9
        },
        "signature_type": "Line",
        "source": "https://github.com/openssl/openssl/commit/e04bd3433fd84e1861bf258ea37928d9845e6a86",
        "target": {
            "file": "include/openssl/opensslv.h"
        },
        "id": "CVE-2022-1292-c377fa22",
        "deprecated": false
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "251633914150035957322733061977107206211",
                "338514574181828579838011565939158652696",
                "76638288692106140328510055542557597351",
                "142922657400765574308962710386922248045",
                "71649992455794854055653842592139575350",
                "65527166711110472566013424527579064967",
                "253196866009476977787139000804413898733",
                "172177136897997206866313011107384691461"
            ],
            "threshold": 0.9
        },
        "target": {
            "file": "crypto/opensslv.h"
        },
        "signature_type": "Line",
        "signature_version": "v1",
        "id": "CVE-2022-1292-e051451f",
        "source": "https://github.com/openssl/openssl/commit/e818b74be2170fbe957a07b0da4401c2b694b3b8"
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-1292.json"

vanir_signatures_modified

"2026-04-12T09:22:09Z"

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "fixed": "2.15"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "10.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.4.0.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "35"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "36"
            }
        ]
    }
]