{"id":"CVE-2022-1343","aliases":["ALPINE-CVE-2022-1343","ALSA-2022:6224","BELL-CVE-2022-1343","EUVD-2022-4552","GHSA-mfm6-r9g2-q4r7","RHSA-2022:6224","RUSTSEC-2022-0027","SUSE-SU-2022:2306-1","UBUNTU-CVE-2022-1343","USN-5402-1","openSUSE-SU-2024:12204-1"],"status":"published","title":"OCSP_basic_verify may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.02158,"percentile":0.8243,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2022-05-03T00:00:00Z","modified":"2026-11-03T07:18:33Z","fixes":[{"ecosystem":"crates.io","package":"openssl-src","fixed_in":["300.0.6"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.17","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"openssl","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"openssl3","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"openssl3","fixed_in":["3.0.3-r0"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"openssl","fixed_in":["3.0.2-0ubuntu1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"openssl-src","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"300.0.0"},{"fixed":"300.0.6"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"openssl3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.3-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"crates.io","package":"openssl-src","ranges":[{"type":"SEMVER","events":[{"introduced":"300.0.0"},{"fixed":"300.0.6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"openssl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::baseos","package":"openssl-libs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.0.1-41.el9_0"}]}],"bundled":5},{"source":"osv","ecosystem":"crates.io","package":"openssl-src","ranges":[{"type":"SEMVER","events":[{"introduced":"300.0.0"},{"fixed":"300.0.6"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150400.4.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.1-150400.4.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.1"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1-1ubuntu2.1~18.04.17"}]}],"versions":["1.0.2g-1ubuntu13","1.0.2g-1ubuntu14","1.0.2n-1ubuntu1","1.1.0g-2ubuntu1","1.1.0g-2ubuntu2","1.1.0g-2ubuntu3","1.1.0g-2ubuntu4","1.1.0g-2ubuntu4.1","1.1.0g-2ubuntu4.3","1.1.1-1ubuntu2.1~18.04.1","1.1.1-1ubuntu2.1~18.04.2","1.1.1-1ubuntu2.1~18.04.3","1.1.1-1ubuntu2.1~18.04.4","1.1.1-1ubuntu2.1~18.04.5","1.1.1-1ubuntu2.1~18.04.6","1.1.1-1ubuntu2.1~18.04.7","1.1.1-1ubuntu2.1~18.04.8","1.1.1-1ubuntu2.1~18.04.9","1.1.1-1ubuntu2.1~18.04.10","1.1.1-1ubuntu2.1~18.04.13","1.1.1-1ubuntu2.1~18.04.14","1.1.1-1ubuntu2.1~18.04.15"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"openssl1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2n-1ubuntu5.9"}]}],"versions":["1.0.2n-1ubuntu2","1.0.2n-1ubuntu3","1.0.2n-1ubuntu4","1.0.2n-1ubuntu5","1.0.2n-1ubuntu5.1","1.0.2n-1ubuntu5.2","1.0.2n-1ubuntu5.3","1.0.2n-1ubuntu5.4","1.0.2n-1ubuntu5.5","1.0.2n-1ubuntu5.6","1.0.2n-1ubuntu5.7","1.0.2n-1ubuntu5.8"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.1f-1ubuntu2.13"}]}],"versions":["1.1.1c-1ubuntu4","1.1.1d-2ubuntu3","1.1.1d-2ubuntu6","1.1.1f-1ubuntu1","1.1.1f-1ubuntu2","1.1.1f-1ubuntu2.1","1.1.1f-1ubuntu2.2","1.1.1f-1ubuntu2.3","1.1.1f-1ubuntu2.4","1.1.1f-1ubuntu2.5","1.1.1f-1ubuntu2.8","1.1.1f-1ubuntu2.9","1.1.1f-1ubuntu2.10","1.1.1f-1ubuntu2.11","1.1.1f-1ubuntu2.12"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"openssl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.2-0ubuntu1.1"}]}],"versions":["1.1.1l-1ubuntu1","3.0.0-1ubuntu1","3.0.1-0ubuntu1","3.0.2-0ubuntu1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"openssl-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.0.5-1.1"}]}],"bundled":6}],"products":[{"vendor":"netapp","product":"a250_firmware"},{"vendor":"netapp","product":"a700s_firmware"},{"vendor":"netapp","product":"active_iq_unified_manager"},{"vendor":"netapp","product":"aff_500f_firmware"},{"vendor":"netapp","product":"aff_8300_firmware"},{"vendor":"netapp","product":"aff_8700_firmware"},{"vendor":"netapp","product":"aff_a400_firmware"},{"vendor":"netapp","product":"clustered_data_ontap"},{"vendor":"netapp","product":"clustered_data_ontap_antivirus_connector"},{"vendor":"netapp","product":"fabric-attached_storage_a400_firmware"},{"vendor":"netapp","product":"fas_500f_firmware"},{"vendor":"netapp","product":"fas_8300_firmware"},{"vendor":"netapp","product":"fas_8700_firmware"},{"vendor":"netapp","product":"h300e_firmware"},{"vendor":"netapp","product":"h300s_firmware"},{"vendor":"netapp","product":"h410s_firmware"},{"vendor":"netapp","product":"h500e_firmware"},{"vendor":"netapp","product":"h500s_firmware"},{"vendor":"netapp","product":"h700e_firmware"},{"vendor":"netapp","product":"h700s_firmware"},{"vendor":"netapp","product":"santricity_smi-s_provider"},{"vendor":"netapp","product":"smi-s_provider"},{"vendor":"netapp","product":"snapmanager"},{"vendor":"netapp","product":"solidfire\\,_enterprise_sds_\\\u0026_hci_storage_node"},{"vendor":"netapp","product":"solidfire_\\\u0026_hci_management_node"},{"vendor":"openssl","product":"openssl"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 tm mfp - gnu/linux subsystem"},{"vendor":"siemens","product":"sinamics perfect harmony gh180"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://www.openssl.org/news/secadv/20220503.txt","tags":["x_transferred","Vendor Advisory","web","article"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a","tags":["x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20220602-0009/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf","tags":["x_transferred","web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-953464.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-419740.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-794697.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-942865.html","tags":["web"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1343","tags":["advisory"]},{"url":"https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2022-0027.html","tags":["web","advisory"]},{"url":"https://github.com/github/advisory-database/issues/405","tags":["web"]},{"url":"https://github.com/advisories/GHSA-mfm6-r9g2-q4r7"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-1343","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:6224","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1292","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1343","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-1473","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2068","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-2097","tags":["report"]},{"url":"https://bugzilla.redhat.com/2081494","tags":["report"]},{"url":"https://bugzilla.redhat.com/2087911","tags":["report"]},{"url":"https://bugzilla.redhat.com/2087913","tags":["report"]},{"url":"https://bugzilla.redhat.com/2097310","tags":["report"]},{"url":"https://bugzilla.redhat.com/2104905","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2022-6224.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-1343","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1343.json","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220602-0009","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2080323","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081494","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082584","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2082585","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2085521","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086554","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2086866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087234","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087911","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091938","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091977","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091994","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2095696","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2101346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2107530","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2112978","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115857","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115858","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115859","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2115861","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2118388","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6224.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1292","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1292","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1343","tags":["advisory","report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1473","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1473","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2068","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2068","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220621.txt","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-2097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2097","tags":["advisory"]},{"url":"https://www.openssl.org/news/secadv/20220705.txt","tags":["article"]},{"url":"https://crates.io/crates/openssl-src","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222306-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185637","tags":["report"]},{"url":"https://bugzilla.suse.com/1199166","tags":["report"]},{"url":"https://bugzilla.suse.com/1199167","tags":["report"]},{"url":"https://bugzilla.suse.com/1199168","tags":["report"]},{"url":"https://bugzilla.suse.com/1199169","tags":["report"]},{"url":"https://bugzilla.suse.com/1200550","tags":["report"]},{"url":"https://bugzilla.suse.com/1201099","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1292","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1434","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1473","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2068","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2097","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1343","tags":["report"]},{"url":"https://mta.openssl.org/pipermail/openssl-announce/2022-May/000224.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5402-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-1292","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1434","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-1473","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-2274","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-1343","title":"OCSP_basic_verify may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T15:15:21.496Z","modified":"2026-10-14T12:43:58.077Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:38.263045Z"}],"euvd":[{"id":"EUVD-2022-4552","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T15:15:21Z","modified":"2026-10-14T12:43:58Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T17:27:15.969628Z"}],"ghsa":[{"id":"GHSA-mfm6-r9g2-q4r7","title":"`OCSP_basic_verify` may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-04T00:00:23Z","modified":"2023-02-14T17:05:07Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:36:45.67005Z"}],"nvd":[{"id":"CVE-2022-1343","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T16:15:18.873Z","modified":"2026-10-14T13:17:18.587Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:18.660414Z"}],"osv":[{"id":"ALPINE-CVE-2022-1343","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T16:15:18.873Z","modified":"2026-11-03T07:18:33.034406774Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T07:51:12.284675Z"},{"id":"BELL-CVE-2022-1343","title":"CVE-2022-1343 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:30.356746Z","modified":"2026-01-26T09:46:19.663625Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-1343","title":"OCSP_basic_verify may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T15:15:21.496Z","modified":"2026-11-11T10:30:57.976120303Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-11T11:06:20.232051Z"},{"id":"GHSA-mfm6-r9g2-q4r7","title":"`OCSP_basic_verify` may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-04T00:00:23Z","modified":"2026-09-10T03:49:34.719762234Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:51.811331Z"},{"id":"RHSA-2022:6224","title":"Red Hat Security Advisory: openssl security and bug fix update","status":"published","published":"2024-09-30T02:23:48Z","modified":"2026-10-15T10:03:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.62945Z"},{"id":"RUSTSEC-2022-0027","title":"`OCSP_basic_verify` may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP\nresponse. In the case where the (non-default) flag OCSP_NOCHECKS is used then\nthe response will be positive (meaning a successful verification) even in the\ncase where the response signing certificate fails to verify.\n\nIt is anticipated that most users of `OCSP_basic_verify` will not use the\nOCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return\na negative value (indicating a fatal error) in the case of a certificate\nverification failure. The normal expected return value in this case would be 0.","status":"published","published":"2022-05-03T12:00:00Z","modified":"2023-11-08T04:07:47.512143Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"UBUNTU-CVE-2022-1343","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL \"ocsp\" application. When verifying an ocsp response with the \"-no_cert_checks\" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).","status":"published","published":"2022-05-03T00:00:00Z","modified":"2026-04-22T13:13:26.139601Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"ALSA-2022:6224","title":"Moderate: openssl security and bug fix update","description":"OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library.\nSecurity Fix(es):\n* openssl: c_rehash script allows command injection (CVE-2022-1292)\n* openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS (CVE-2022-1343)\n* openssl: OPENSSL_LH_flush() breaks reuse of memory (CVE-2022-1473)\n* openssl: the c_rehash script allows command injection (CVE-2022-2068)\n* openssl: AES OCB fails to encrypt some bytes (CVE-2022-2097)\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\nBug Fix(es):\n* openssl occasionally sends internal error to gnutls when using FFDHE (BZ#2080323)\n* openssl req defaults to 3DES (BZ#2085499)\n* OpenSSL accepts custom elliptic curve parameters when p is large [almalinux-9] (BZ#2085508)\n* OpenSSL mustn't work with ECDSA with explicit curve parameters in FIPS mode (BZ#2085521)\n* openssl s_server -groups secp256k1 in FIPS fails because X25519/X448 (BZ#2086554)\n* Converting FIPS power-on self test to KAT (BZ#2086866)\n* Small RSA keys work for some operations in FIPS mode (BZ#2091938)\n* FIPS provider doesn't block RSA encryption for key transport (BZ#2091977)\n* OpenSSL testsuite certificates expired (BZ#2095696)\n* [IBM 9.1 HW OPT] POWER10 performance enhancements for cryptography: OpenSSL (BZ#2103044)\n* [FIPS lab review] self-test (BZ#2112978)\n* [FIPS lab review] DH tuning (BZ#2115856)\n* [FIPS lab review] EC tuning (BZ#2115857)\n* [FIPS lab review] RSA tuning (BZ#2115858)\n* [FIPS lab review] RAND tuning (BZ#2115859)\n* [FIPS lab review] zeroization (BZ#2115861)\n* [FIPS lab review] HKDF limitations (BZ#2118388)","status":"published","published":"2022-08-30T00:00:00Z","modified":"2026-10-29T11:31:13.957033679Z","updated_at":"2026-11-02T15:27:51.655726Z"},{"id":"openSUSE-SU-2024:12204-1","title":"libopenssl-3-devel-3.0.5-1.1 on GA media","description":"These are all security issues fixed in the libopenssl-3-devel-3.0.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:41:08.192105Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:2306-1","title":"Security update for openssl-3","description":"This update for openssl-3 fixes the following issues:\n\n- CVE-2022-2068: Fixed more shell code injection issues in c_rehash. (bsc#1200550)\n- CVE-2022-1292: Properly sanitise shell metacharacters in c_rehash script. (bsc#1199166) \n- CVE-2022-1343: Fixed incorrect signature verification in OCSP_basic_verify (bsc#1199167).\n- CVE-2022-2097: Fixed partial missing encryption in AES OCB mode (bsc#1201099).\n- CVE-2022-1434: Fixed incorrect MAC key used in the RC4-MD5 ciphersuite (bsc#1199168).\n- CVE-2022-1473: Fixed resource leakage when decoding certificates and keys (bsc#1199169).\n","status":"published","published":"2022-07-06T11:49:35Z","modified":"2025-05-02T04:32:26.510207Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5402-1","title":"openssl, openssl1.0 vulnerabilities","description":"Elison Niven discovered that OpenSSL incorrectly handled the c_rehash\nscript. A local attacker could possibly use this issue to execute arbitrary\ncommands when c_rehash is run. (CVE-2022-1292)\n\nRaul Metsma discovered that OpenSSL incorrectly verified certain response\nsigning certificates. A remote attacker could possibly use this issue to\nspoof certain response signing certificates. This issue only affected\nUbuntu 22.04 LTS. (CVE-2022-1343)\n\nTom Colley discovered that OpenSSL used the incorrect MAC key in the\nRC4-MD5 ciphersuite. In non-default configurations were RC4-MD5 is enabled,\na remote attacker could possibly use this issue to modify encrypted\ncommunications. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1434)\n\nAliaksei Levin discovered that OpenSSL incorrectly handled resources when\ndecoding certificates and keys. A remote attacker could possibly use this\nissue to cause OpenSSL to consume resources, leading to a denial of\nservice. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-1473)\n","status":"published","published":"2022-05-04T13:21:13Z","modified":"2026-04-27T16:19:01.380842412Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}