CVE-2022-1343Medium· 5.3▾ SunlitThe function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
1.2% → 2.1%
The function OCSP_basic_verify verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of OCSP_basic_verify will not use the OCSP_NOCHECKS flag. In this case the OCSP_basic_verify function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
openssl >= 3.0.0, < 3.0.3active_iq_unified_managerclustered_data_ontapclustered_data_ontap_antivirus_connectorsantricity_smi-s_providersmi-s_providersnapmanagersolidfire,_enterprise_sds_&_hci_storage_nodesolidfire_&_hci_management_nodea250_firmwarea700s_firmwareaff_500f_firmwareaff_8300_firmwareaff_8700_firmwareaff_a400_firmwarefabric-attached_storage_a400_firmwarefas_500f_firmwarefas_8300_firmwarefas_8700_firmwareh300e_firmwareh300s_firmwareh410s_firmwareh500e_firmwareh500s_firmwareh700e_firmwareh700s_firmwareUpgrade past the affected range:
openssl 3.0.3Connected by shared product, vendor, weakness, or advisory.
CVE-2023-0466Medium· 5.3The function X509_VERIFY_PARAM_add0_policy() is documented to implicitly enable the certificate policy check when doing certificate verification
CVE-2023-0465Medium· 5.3Applications that use a non-default option when verifying certificates may be vulnerable to an attack from a malicious CA to circumvent certain checks. Invalid certificate policies in leaf certificates are silently ignored by OpenSSL an…
CVE-2023-0464High· 7.5A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints
CVE-2022-1473High· 7.5The OPENSSL_LH_flush() function, which empties a hash table, contains a bug that breaks reuse of the memory occuppied by the removed hash table entries
CVE-2022-1434Medium· 5.9The OpenSSL 3.0 implementation of the RC4-MD5 ciphersuite incorrectly uses the AAD data as the MAC key
CVE-2023-5678Medium· 5.3Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications that use the functions DH_generate_key() to generate an X9.42 DH key may ex…