CVE-2022-43705
CVE-2022-43705 affecting package botan2 2.14.0-2
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
CVE-2022-43705- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
CVE-2022-43705- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Weakness
- CWE-295
- Updated
- 2026-11-02
EUVDEUVD-2022-46687
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
EUVD-2022-46687- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVAZL-44751
CVE-2022-43705 affecting package botan2 2.14.0-2
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
AZL-44751- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-05
OSV
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
CVE-2022-43705- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
DEBIAN-CVE-2022-43705- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
Show 5 moreShow less
OSVUBUNTU-CVE-2022-43705
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
- Record
UBUNTU-CVE-2022-43705- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2022-0445 No score
Updated botan packages fix security vulnerability
Fixed validation of embedded certificates was when checking OCSP responses (CVE-2022-43705)
- Record
MGASA-2022-0445- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10210-1 No score
Security update for Botan
This update for Botan fixes the following issues:
- CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509).
- Record
openSUSE-SU-2022:10210-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2022:10211-1 No score
Security update for Botan
This update for Botan fixes the following issues:
- CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509).
- Record
openSUSE-SU-2022:10211-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12522-1 No score
Botan-2.19.3-1.1 on GA media
These are all security issues fixed in the Botan-2.19.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12522-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
botan2Azure Linux:3 |
through 2.14.0-2 | None known |
botanDebian:12 |
before 2.19.3+dfsg-1 | 2.19.3+dfsg-1 |
botanDebian:13 |
before 2.19.3+dfsg-1 | 2.19.3+dfsg-1 |
botan2Mageia:8 |
before 2.17.3-2.2.mga8 | 2.17.3-2.2.mga8 |
botanUbuntu:18.04:LTS |
All versions, plus listed versions 2.4.0-32.4.0-42.4.0-5ubuntu1 |
None known |
botanUbuntu:20.04:LTS |
All versions, plus listed versions 2.9.0-22.9.0-2build12.12.1-22.12.1-2build1 |
None known |
botanUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2.17.3+dfsg-32.19.1+dfsg-2ubuntu12.19.1+dfsg-2ubuntu1+esm1 |
None known |
BotanSUSE:Package Hub 15 SP3 |
before 2.10.0-bp153.3.3.1 | 2.10.0-bp153.3.3.1 |
BotanopenSUSE:Leap 15.3 |
before 2.10.0-bp153.3.3.1 | 2.10.0-bp153.3.3.1 |
BotanSUSE:Package Hub 15 SP4 |
before 2.18.2-bp154.2.3.1 | 2.18.2-bp154.2.3.1 |
BotanopenSUSE:Leap 15.4 |
before 2.18.2-bp154.2.3.1 | 2.18.2-bp154.2.3.1 |
BotanopenSUSE:Tumbleweed |
before 2.19.3-1.1 | 2.19.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-43705 is a critical vulnerability (CVSS 9.1) in Botan Project Botan, published November 23, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in botan 2.19.3+dfsg-1.
References
github.com/randombit/botan/releases/tag/2.19.3
nvd.nist.gov/vuln/detail/CVE-2022-43705
security-tracker.debian.org/tracker/CVE-2022-43705
advisories.mageia.org/MGASA-2022-0445.html
Show 16 moreShow less
bugs.mageia.org/show_bug.cgi?id=31176
suse.com/security/cve/CVE-2022-43705.html
ubuntu.com/security/CVE-2022-43705
cve.org/CVERecord?id=CVE-2022-43705
lists.opensuse.org/archives/list/[email protected]/thread/CK2O4INVIIS67Y5GFNHP5FVF7LRHAETD
bugzilla.suse.com/1205509