Log in Start free

Vulnerability · Published May 3, 2022 · Assigned by openssl

CVE-2022-1343OCSP_basic_verify may incorrectly verify the response signing certificate

Medium 5.3

In plain English

A medium-severity improper certificate validation in OpenSSL from OpenSSL. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.2% (higher than 82% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)2.2%top 17.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9openssl1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:9openssl-devel1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:9openssl-libs1:3.0.1-41.el9_0ALSA-2022:6224
AlmaLinux:9openssl-perl1:3.0.1-41.el9_0ALSA-2022:6224
Alpine:v3.20openssl3.0.3-r0ALPINE-CVE-2022-1343
Alpine:v3.21openssl3.0.3-r0ALPINE-CVE-2022-1343
Alpine:v3.22openssl3.0.3-r0ALPINE-CVE-2022-1343
Alpine:v3.23openssl3.0.3-r0ALPINE-CVE-2022-1343
Alpine:v3.24openssl3.0.3-r0ALPINE-CVE-2022-1343
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.1USN-5402-1
Ubuntu:22.04:LTSopenssl3.0.2-0ubuntu1.1UBUNTU-CVE-2022-1343

Affected products (as reported)

VendorProductVersions
OpenSSL OpenSSL Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2)

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References