[PATCH] openssl: bump to 1.1.1p
a.heider at gmail.com
Thu Jun 23 00:08:07 PDT 2022
Changes between 1.1.1o and 1.1.1p [21 Jun 2022]
*) In addition to the c_rehash shell command injection identified in
CVE-2022-1292, further bugs where the c_rehash script does not
properly sanitise shell metacharacters to prevent command injection have been
When the CVE-2022-1292 was fixed it was not discovered that there
are other places in the script where the file names of certificates
being hashed were possibly passed to a command executed through the shell.
This script is distributed by some operating systems in a manner where
it is automatically executed. On such operating systems, an attacker
could execute arbitrary commands with the privileges of the script.
Use of the c_rehash script is considered obsolete and should be replaced
by the OpenSSL rehash command line tool.
[Daniel Fiala, Tomáš Mráz]
*) When OpenSSL TLS client is connecting without any supported elliptic
curves and TLS-1.3 protocol is disabled the connection will no longer fail
if a ciphersuite that does not use a key exchange based on elliptic
curves can be negotiated.
Signed-off-by: Andre Heider <a.heider at gmail.com>
package/libs/openssl/Makefile | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/package/libs/openssl/Makefile b/package/libs/openssl/Makefile
index b496f2f9f2..ed618568a4 100644
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
@@ -25,7 +25,7 @@ PKG_SOURCE_URL:= \
More information about the openwrt-devel