OCSP_basic_verify may incorrectly verify the response signing certificate
Priority LOW 34CWE-295Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-295.
Summary
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.02158 82nd percentileScored 2026-11-07
Fix Fixed openssl-src (crates.io): 300.0.6Red Hat: 1 advisory
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenSSL | OpenSSL | Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) | — | No fix listed | CNA |
| — | openssl-src (crates.io) | 300.0.0 to before 300.0.6 | 300.0.6 | Patch available | GHSA-mfm6-r9g2-q4r7 |
- OpenSSL VendorOpenSSL Affected Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2) Fixed in — No fix listed CNA
- openssl-src (crates.io) Vendor— Affected 300.0.0 to before 300.0.6 Fixed in 300.0.6 Patch available GHSA-mfm6-r9g2-q4r7
CPE configurations NVD · 43
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* | 3.0.0 to before 3.0.3 | Vulnerable | OpenSSL |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:* Versions 3.0.0 to before 3.0.3 Vulnerable ·OpenSSL
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 33 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
- cpe:2.3:h:netapp:a250:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:aff_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_500f:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8300:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:fas_8700:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
Remediation
- Fix · GHSA-mfm6-r9g2-q4r7 openssl-src (crates.io) Fixed in 300.0.6 Advisory →
Red Hat 1 advisory
- RHSA-2022:6224 Released 2022-08-30 · Red Hat rating Moderateopenssl security and bug fix update
- Red Hat Enterprise Linux AppStream (v. 9) openssl-devel-1:3.0.1-41.el9_0, openssl-perl-1:3.0.1-41.el9_0
- Red Hat Enterprise Linux BaseOS (v. 9) openssl-1:3.0.1-41.el9_0, openssl-libs-1:3.0.1-41.el9_0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2022:6224 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2022:6224 |
Not affected: 7 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Web Server 3
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2022-1343
- 2026-10-03 Alias added: GHSA-mfm6-r9g2-q4r7
References
Advisory 3
Other 6
- https://git.openssl.org/gitweb/?p=openssl.git%3Ba=commitdiff%3Bh=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a
- https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
- https://github.com/github/advisory-database/issues/405
- https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a
- https://rustsec.org/advisories/RUSTSEC-2022-0027.html
- https://security.netapp.com/advisory/ntap-20220602-0009
More Openssl vulnerabilities
- TI-2022-01915 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2021-02645 SM2 Decryption Buffer Overflow CVSS 3.1CRITICAL 9.8
- TI-2009-03392 The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft… CVSS 3.1CRITICAL 9.8
- TI-2022-01176 The c_rehash script allows command injection CVSS 3.1CRITICAL 9.8
- TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
- TI-2025-14107 Stack buffer overflow in CMS (Auth)EnvelopedData parsing CVSS 3.1HIGH 8.8
Sources
- CVE-2022-1343 · CVE Program
- CVE-2022-1343 · NVD
- FIRST EPSS
- GHSA-mfm6-r9g2-q4r7 · GitHub Advisory Database · CC BY 4.0
- CVE-2022-1343 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences