{"id":"CVE-2022-43705","aliases":["AZL-44751","DEBIAN-CVE-2022-43705","EUVD-2022-46687","GHSA-4v9w-qvcq-6q7w","MGASA-2022-0445","UBUNTU-CVE-2022-43705","openSUSE-SU-2022:10210-1","openSUSE-SU-2022:10211-1","openSUSE-SU-2024:12522-1"],"status":"published","title":"CVE-2022-43705 affecting package botan2 2.14.0-2","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","severity":{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00463,"percentile":0.4043,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2022-11-23T08:36:49Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Debian:12","package":"botan","fixed_in":["2.19.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"botan","fixed_in":["2.19.3+dfsg-1"],"sources":["osv"]},{"ecosystem":"Mageia:8","package":"botan2","fixed_in":["2.17.3-2.2.mga8"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP3","package":"Botan","fixed_in":["2.10.0-bp153.3.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"Botan","fixed_in":["2.10.0-bp153.3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP4","package":"Botan","fixed_in":["2.18.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"Botan","fixed_in":["2.18.2-bp154.2.3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"Botan","fixed_in":["2.19.3-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.14.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"botan2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17.3-2.2.mga8"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.4.0-3","2.4.0-4","2.4.0-5ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.9.0-2","2.9.0-2build1","2.12.1-2","2.12.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.17.3+dfsg-3","2.19.1+dfsg-2ubuntu1","2.19.1+dfsg-2ubuntu1+esm1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP3","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-bp153.3.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.10.0-bp153.3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP4","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18.2-bp154.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"Botan","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.19.3-1.1"}]}]}],"products":[{"vendor":"botan_project","product":"botan"}],"references":[{"url":"https://github.com/randombit/botan/releases/tag/2.19.3","tags":["x_transferred","Release Notes","Third Party Advisory","web"]},{"url":"https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7w","tags":["x_transferred","Mitigation","Third Party Advisory","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-43705","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/43xxx/CVE-2022-43705.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-43705","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0445.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=31176","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43705.html","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-43705","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/fd83d9e262f63fb673e4c13ca37e5b768e41e812","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/4e35073ff356e37c3adcf1ff3522e9d0d48c765f","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/c2faa88b0281e5017be72e1c85d0c41f686e1928","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/5d8d9fbf75c8b814ea609161bee525d520f5cb57","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/1829ef9d89614da1eacdf511356bdf98a970f5f5","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/991b0159282781f2d5c06ff42a9ff00ee563e96b","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/a33689613127f319c0047fb96f092de16e7cb350","tags":["report"]},{"url":"https://github.com/randombit/botan/commit/909c62717855402e04dbaf8ffc085f444d547aae","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-43705","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CK2O4INVIIS67Y5GFNHP5FVF7LRHAETD/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1205509","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-43705","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BTCNO3M6FEDJQGUUPVOQE3OWQZIUMQ3A/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-43705","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T00:00:00Z","modified":"2025-04-25T19:21:47.339Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:34:25.618175Z"}],"euvd":[{"id":"EUVD-2022-46687","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T00:00:00Z","modified":"2025-04-25T19:21:47Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T20:52:02.538258Z"}],"nvd":[{"id":"CVE-2022-43705","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T04:15:10.237Z","modified":"2026-06-17T05:07:10.69Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical","assessor":"primary"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:07:32.827264Z"}],"osv":[{"id":"AZL-44751","title":"CVE-2022-43705 affecting package botan2 2.14.0-2","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T04:15:10Z","modified":"2026-11-05T05:36:30Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-05T16:41:20.107976Z"},{"id":"CVE-2022-43705","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T00:00:00Z","modified":"2026-10-28T02:30:22.795694892Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:27.186787Z"},{"id":"DEBIAN-CVE-2022-43705","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T04:15:10.237Z","modified":"2026-11-03T08:03:08.731639766Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-03T08:24:39.643572Z"},{"id":"UBUNTU-CVE-2022-43705","description":"In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).","status":"published","published":"2022-11-27T04:15:00Z","modified":"2026-04-22T13:30:41.097233Z","cvss":[{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","level":"critical"},{"version":"3.1","score":9.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"critical"}],"updated_at":"2026-11-02T16:53:56.473586Z"},{"id":"MGASA-2022-0445","title":"Updated botan packages fix security vulnerability","description":"Fixed validation of embedded certificates was when checking OCSP responses\n(CVE-2022-43705)\n","status":"published","published":"2022-11-27T20:51:49Z","modified":"2026-04-16T04:41:47.761409843Z","updated_at":"2026-11-02T15:49:42.263076Z"},{"id":"openSUSE-SU-2022:10210-1","title":"Security update for Botan","description":"This update for Botan fixes the following issues:\n\n- CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509).\n","status":"published","published":"2022-11-23T08:36:49Z","modified":"2025-05-07T18:14:25.676666Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2022:10211-1","title":"Security update for Botan","description":"This update for Botan fixes the following issues:\n\n- CVE-2022-43705: Fixed validation of embedded certificates was when checking OCSP responses (boo#1205509).\n","status":"published","published":"2022-11-23T08:37:11Z","modified":"2025-05-07T18:14:25.736506Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:12522-1","title":"Botan-2.19.3-1.1 on GA media","description":"These are all security issues fixed in the Botan-2.19.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:32:00.509089Z","updated_at":"2026-11-02T16:58:35.751245Z"}]}}