CVE-2022-2068 is a critical command injection vulnerability found in the c_rehash script distributed with OpenSSL versions 3.0.0 through 3.0.3, 1.1.1 through 1.1.1o, and 1.0.2 through 1.0.2ze. The vulnerability arises because the c_rehash script does not properly sanitize shell metacharacters in certificate file names before passing them to shell commands. This improper sanitization allows an attacker to inject arbitrary shell commands that will be executed with the privileges of the script. The c_rehash script is used to create symbolic links to hashed certificate files, and on some operating systems, it is automatically executed, increasing the risk of exploitation. The vulnerability is a variant of CWE-78 (Improper Neutralization of Special Elements used in an OS Command), and was discovered during code review following a previous related vulnerability (CVE-2022-1292). The issue has been fixed by replacing the c_rehash script with the OpenSSL rehash command line tool in OpenSSL versions 3.0.4, 1.1.1p, and 1.0.2zf. The CVSS v3.1 base score is 9.8, indicating a critical severity with network attack vector, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported yet, but the high severity and ease of exploitation make this a significant threat.

For European organizations, this vulnerability poses a severe risk due to the widespread use of OpenSSL in servers, network appliances, and various software stacks. Exploitation could lead to full system compromise, allowing attackers to execute arbitrary commands remotely without authentication or user interaction. This could result in data breaches, service disruptions, and lateral movement within networks. Organizations relying on automated certificate management or systems that invoke the c_rehash script automatically are particularly vulnerable. Given OpenSSL's integral role in securing communications and cryptographic operations, exploitation could undermine trust in secure channels and expose sensitive information. The vulnerability's critical nature means that attackers could leverage it to gain persistent footholds or disrupt critical infrastructure, which is especially concerning for sectors like finance, healthcare, and government within Europe.

European organizations should immediately verify if their systems use affected OpenSSL versions and the c_rehash script. They must upgrade to patched versions: OpenSSL 3.0.4, 1.1.1p, or 1.0.2zf as appropriate. Systems should replace usage of the obsolete c_rehash script with the supported OpenSSL rehash command line tool. Additionally, organizations should audit automated processes that invoke c_rehash to ensure they do not execute untrusted certificate files or filenames containing shell metacharacters. Implementing strict input validation and sanitization on certificate file names is critical. Where upgrading is not immediately possible, restricting execution permissions of the c_rehash script and isolating systems that run it can reduce risk. Monitoring logs for unusual command execution patterns related to certificate hashing operations can help detect exploitation attempts. Finally, organizations should review their incident response plans to quickly address any signs of compromise related to this vulnerability.