CVE-2022-1343
OCSP_basic_verify may incorrectly verify the response signing certificate
- Published
- Updated
- Reserved
- Assigned by
- openssl
Description
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Timeline
ID reserved
By openssl
- 20 days later
· 20 days later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| CISA-ADPADP (enrichment) | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
- EPSS (exploitation in 30 days)
- 2.2% · top 18% of all CVEs (7 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.
Weakness
- Incorrect signature verfication
- CWE-295 Improper Certificate Validation (opens in a new tab)All about CWE-295 and its CVEs
Affected products
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- crates.ioopenssl-srcGHSA-mfm6-r9g2-q4r7 (opens in a new tab)
References (9)
- https://www.openssl.org/news/secadv/20220503.txt (opens in a new tab)x_transferred
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a (opens in a new tab)x_transferred
- https://security.netapp.com/advisory/ntap-20220602-0009/ (opens in a new tab)x_transferred
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf (opens in a new tab)x_transferred
- https://cert-portal.siemens.com/productcert/html/ssa-953464.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-419740.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-794697.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-942865.html (opens in a new tab)
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-mfm6-r9g2-q4r7 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2022-1343)Record last updated .