OpenSSL 1

Tenable plugin 160477 maps to CVE-2022-1292, a command-injection flaw in OpenSSL's c_rehash helper script, not in the core TLS handshake path. The vulnerable ranges are OpenSSL 1.1.1 through 1.1.1n, 3.0.0 through 3.0.2, and 1.0.2 through 1.0.2zd; upstream fixed them in 1.1.1o, 3.0.3, and 1.0.2ze. On some operating systems, c_rehash may be auto-invoked while processing certificate directories, which lets a malicious filename trigger shell metacharacter injection with the privileges of the script.

The scary part is the *impact* if you can hit the path; the non-scary part is that most attackers cannot. The vendor/plugin labeling gets inflated by legacy CVSS v2 10.0 and a misleading CISA-ADP 9.8 network score, but NVD's own CVSS v3.1 7.3 already shows the real constraints: local attack vector, low privileges required, user interaction required. In enterprise reality this is usually a post-initial-access edge case, often further narrowed by distro backports and by the fact that many fleets never run c_rehash at all.

Why this verdict

• Start from the vendor's realistic baseline, not the legacy panic score: the meaningful baseline is NVD's 7.3 HIGH with AV:L/PR:L/UI:R, not the older 10.0 CVSS v2 or CISA-ADP's 9.8 network framing
• Requires post-initial-access conditions: attacker needs local/authenticated reach plus the ability to place crafted filenames into a certificate path, which implies a prior compromise stage or a very specific app workflow
• Reachable population is small: many systems have OpenSSL installed but never run c_rehash, and many modern builds use openssl rehash or omit the helper entirely
• Detection and containment are stronger than average: shell spawning from cert-maintenance or package processes is noisy and commonly visible to EDR
• Scanner inflation is real: Tenable's own plugin says it is version-based only, so backported distro packages and non-invoked script paths get overstated

Why not higher?

Because the exploit chain does not begin with an unauthenticated remote network request to OpenSSL. You need a foothold, a writable path, and the vulnerable helper script to run; each of those gates compounds downward pressure on severity. There is also no KEV entry or strong primary-source evidence of broad active exploitation.

Why not lower?

Because if the path is present, command execution can be real and severe, especially when c_rehash runs from privileged admin or package-management context. On shared Linux systems, cert-management appliances, or products that auto-process certificate directories, the local impact can still become full host compromise.

1. Inventory c_rehash — Determine whether affected hosts actually ship or invoke c_rehash; this is the fastest way to collapse false urgency. For a LOW verdict there is no SLA beyond backlog hygiene, so complete this during the next routine validation cycle and document hosts where the script is absent.
2. Block untrusted writes to certificate stores — Tighten permissions on certificate directories and any application workflow that imports CA bundles or PEM files. That removes the attacker-controlled filename prerequisite; for LOW severity, implement as normal hardening work rather than an emergency change.
3. Prefer openssl rehash — Where operationally safe, replace legacy c_rehash usage with the supported openssl rehash tool called without shell-evaluated file paths. Treat this as maintenance-cycle cleanup for this LOW issue.
4. Alert on shell children from cert tooling — Create EDR/process alerts for c_rehash, package hooks, or certificate-maintenance jobs spawning /bin/sh, bash, curl, or wget. This is a practical detective control for the narrow exploitation path and can be rolled out in standard detection engineering cadence.

Run this on the target Linux host that Nessus flagged, not from an auditor workstation. Invoke it as bash check-cve-2022-1292.sh; no root is required, though sudo helps if package metadata access is restricted. The script checks whether c_rehash is present, then uses distro/package evidence and upstream version thresholds to print VULNERABLE, PATCHED, or UNKNOWN.

#!/usr/bin/env bash
# check-cve-2022-1292.sh
# Purpose: assess likely exposure to OpenSSL c_rehash command injection (CVE-2022-1292)
# Output: VULNERABLE | PATCHED | UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

say() { printf '%s\n' "$1"; }
ver_ge() {
  # returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s\n' "$2" "$1" | sort -V | head -n1)" = "$2" ]
}

OS_ID="unknown"
OS_VER="unknown"
if [ -r /etc/os-release ]; then
  . /etc/os-release
  OS_ID="${ID:-unknown}"
  OS_VER="${VERSION_ID:-unknown}"
fi

# Locate c_rehash
CREHASH=""
for p in "$(command -v c_rehash 2>/dev/null || true)" /usr/bin/c_rehash /usr/sbin/c_rehash /usr/local/bin/c_rehash /usr/local/ssl/bin/c_rehash; do
  if [ -n "$p" ] && [ -e "$p" ]; then
    CREHASH="$p"
    break
  fi
done

if [ -z "$CREHASH" ]; then
  say "PATCHED - c_rehash not found on this host; the vulnerable helper path is absent"
  exit 0
fi

# Prefer package-manager evidence because distro backports are common.
if command -v dpkg-query >/dev/null 2>&1 && command -v dpkg >/dev/null 2>&1; then
  PKG_VER="$(dpkg-query -W -f='${Version}' openssl 2>/dev/null || true)"
  if [ -n "$PKG_VER" ]; then
    case "$OS_ID:$OS_VER" in
      debian:10)
        if dpkg --compare-versions "$PKG_VER" ge "1.1.1n-0+deb10u2"; then
          say "PATCHED - Debian 10 openssl package version $PKG_VER includes the fix/backport"
          exit 0
        else
          say "VULNERABLE - Debian 10 openssl package version $PKG_VER is older than 1.1.1n-0+deb10u2"
          exit 1
        fi
        ;;
      debian:11)
        if dpkg --compare-versions "$PKG_VER" ge "1.1.1n-0+deb11u2"; then
          say "PATCHED - Debian 11 openssl package version $PKG_VER includes the fix/backport"
          exit 0
        else
          say "VULNERABLE - Debian 11 openssl package version $PKG_VER is older than 1.1.1n-0+deb11u2"
          exit 1
        fi
        ;;
      ubuntu:22.04)
        # Ubuntu Jammy fixed via USN-5402-1
        if dpkg --compare-versions "$PKG_VER" ge "3.0.2-0ubuntu1.1"; then
          say "PATCHED - Ubuntu 22.04 openssl package version $PKG_VER includes the fix/backport"
          exit 0
        else
          say "VULNERABLE - Ubuntu 22.04 openssl package version $PKG_VER is older than 3.0.2-0ubuntu1.1"
          exit 1
        fi
        ;;
    esac
  fi
fi

if command -v rpm >/dev/null 2>&1; then
  if rpm -q openssl >/dev/null 2>&1; then
    if rpm -q --changelog openssl 2>/dev/null | grep -q 'CVE-2022-1292'; then
      say "PATCHED - rpm changelog for openssl references CVE-2022-1292 backport"
      exit 0
    fi
  fi
fi

# Fall back to upstream version-string logic for source builds or non-backported installs.
OPENSSL_VER_RAW="$(openssl version 2>/dev/null || true)"
OPENSSL_VER="$(printf '%s' "$OPENSSL_VER_RAW" | awk '{print $2}')"
if [ -n "$OPENSSL_VER" ]; then
  case "$OPENSSL_VER" in
    1.1.1*)
      if ver_ge "$OPENSSL_VER" "1.1.1o"; then
        say "PATCHED - upstream OpenSSL version $OPENSSL_VER is >= 1.1.1o"
        exit 0
      else
        say "VULNERABLE - upstream OpenSSL version $OPENSSL_VER is < 1.1.1o and c_rehash is present"
        exit 1
      fi
      ;;
    3.0.*)
      if ver_ge "$OPENSSL_VER" "3.0.3"; then
        say "PATCHED - upstream OpenSSL version $OPENSSL_VER is >= 3.0.3"
        exit 0
      else
        say "VULNERABLE - upstream OpenSSL version $OPENSSL_VER is < 3.0.3 and c_rehash is present"
        exit 1
      fi
      ;;
    1.0.2*)
      if ver_ge "$OPENSSL_VER" "1.0.2ze"; then
        say "PATCHED - upstream OpenSSL version $OPENSSL_VER is >= 1.0.2ze"
        exit 0
      else
        say "VULNERABLE - upstream OpenSSL version $OPENSSL_VER is < 1.0.2ze and c_rehash is present"
        exit 1
      fi
      ;;
  esac
fi

say "UNKNOWN - c_rehash exists, but package/backport status could not be proven from available metadata"
exit 2

Sources

1. Tenable Nessus plugin 160477
2. Tenable CVE page for CVE-2022-1292
3. NVD CVE-2022-1292
4. OpenSSL vulnerabilities for 1.1.1
5. Debian DSA-5139-1 openssl security update
6. Ubuntu USN-5402-1 OpenSSL vulnerabilities
7. MITRE CVE record
8. Public PoC repository