Security update for openssl-1_1 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2075-1 Final 1 1 2022-06-14T10:01:06Z current 2022-06-14T10:01:06Z 2022-06-14T10:01:06Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for openssl-1_1 This update for openssl-1_1 fixes the following issues: - CVE-2022-1292: Fixed command injection in c_rehash (bsc#1199166). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Container suse/sle15:15.0-2022-2075,SUSE-2022-2075,SUSE-SLE-Product-HPC-15-2022-2075,SUSE-SLE-Product-SLES-15-2022-2075,SUSE-SLE-Product-SLES_SAP-15-2022-2075 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222075-1/ Link for SUSE-SU-2022:2075-1 https://lists.suse.com/pipermail/sle-security-updates/2022-June/011282.html E-Mail link for SUSE-SU-2022:2075-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1185637 SUSE Bug 1185637 https://bugzilla.suse.com/1199166 SUSE Bug 1199166 https://www.suse.com/security/cve/CVE-2022-1292/ SUSE CVE CVE-2022-1292 page Container suse/sle15:15.0 SUSE Linux Enterprise High Performance Computing 15-ESPOS SUSE Linux Enterprise High Performance Computing 15-LTSS SUSE Linux Enterprise Server 15-LTSS SUSE Linux Enterprise Server for SAP Applications 15 libopenssl1_1-1.1.0i-150000.4.69.1 openssl-1_1-1.1.0i-150000.4.69.1 libopenssl-1_1-devel-1.1.0i-150000.4.69.1 libopenssl-1_1-devel-32bit-1.1.0i-150000.4.69.1 libopenssl-1_1-devel-64bit-1.1.0i-150000.4.69.1 libopenssl1_1-32bit-1.1.0i-150000.4.69.1 libopenssl1_1-64bit-1.1.0i-150000.4.69.1 libopenssl1_1-hmac-1.1.0i-150000.4.69.1 libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 libopenssl1_1-hmac-64bit-1.1.0i-150000.4.69.1 openssl-1_1-doc-1.1.0i-150000.4.69.1 libopenssl1_1-1.1.0i-150000.4.69.1 as a component of Container suse/sle15:15.0 openssl-1_1-1.1.0i-150000.4.69.1 as a component of Container suse/sle15:15.0 libopenssl-1_1-devel-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libopenssl1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libopenssl1_1-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libopenssl1_1-hmac-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS openssl-1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-ESPOS libopenssl-1_1-devel-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libopenssl1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libopenssl1_1-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libopenssl1_1-hmac-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS openssl-1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise High Performance Computing 15-LTSS libopenssl-1_1-devel-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS libopenssl1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS libopenssl1_1-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS libopenssl1_1-hmac-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS openssl-1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server 15-LTSS libopenssl-1_1-devel-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libopenssl1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libopenssl1_1-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libopenssl1_1-hmac-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 openssl-1_1-1.1.0i-150000.4.69.1 as a component of SUSE Linux Enterprise Server for SAP Applications 15 The c_rehash script does not properly sanitise shell metacharacters to prevent command injection. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2). Fixed in OpenSSL 1.1.1o (Affected 1.1.1-1.1.1n). Fixed in OpenSSL 1.0.2ze (Affected 1.0.2-1.0.2zd). CVE-2022-1292 Container suse/sle15:15.0:libopenssl1_1-1.1.0i-150000.4.69.1 Container suse/sle15:15.0:openssl-1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libopenssl-1_1-devel-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libopenssl1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libopenssl1_1-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libopenssl1_1-hmac-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS:openssl-1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libopenssl-1_1-devel-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libopenssl1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libopenssl1_1-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libopenssl1_1-hmac-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise High Performance Computing 15-LTSS:openssl-1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:libopenssl-1_1-devel-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:libopenssl1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:libopenssl1_1-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:libopenssl1_1-hmac-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server 15-LTSS:openssl-1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:libopenssl-1_1-devel-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:libopenssl1_1-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:libopenssl1_1-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:libopenssl1_1-hmac-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:libopenssl1_1-hmac-32bit-1.1.0i-150000.4.69.1 SUSE Linux Enterprise Server for SAP Applications 15:openssl-1_1-1.1.0i-150000.4.69.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222075-1/ https://www.suse.com/security/cve/CVE-2022-1292.html CVE-2022-1292 https://bugzilla.suse.com/1199166 SUSE Bug 1199166 https://bugzilla.suse.com/1200550 SUSE Bug 1200550 https://bugzilla.suse.com/1200650 SUSE Bug 1200650 https://bugzilla.suse.com/1200758 SUSE Bug 1200758 https://bugzilla.suse.com/1202688 SUSE Bug 1202688