CVE-2022-1343: The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used t...

Description

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability

1.10%

61.5th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Openssl	Openssl	>= 3.0.0, < 3.0.3
Netapp	Active Iq Unified Manager	All versions
Netapp	Clustered Data Ontap	All versions
Netapp	Clustered Data Ontap Antivirus Connector	All versions
Netapp	Santricity Smi-S Provider	All versions
Netapp	Smi-S Provider	All versions
Netapp	Snapmanager	All versions
Netapp	Solidfire\, Enterprise Sds \& Hci Storage Node	All versions
Netapp	Solidfire \& Hci Management Node	All versions
Netapp	A250 Firmware	All versions
Netapp	A700s Firmware	All versions
Netapp	Aff 500f Firmware	All versions
Netapp	Aff 8300 Firmware	All versions
Netapp	Aff 8700 Firmware	All versions
Netapp	Aff A400 Firmware	All versions
Netapp	Fabric-Attached Storage A400 Firmware	All versions
Netapp	Fas 500f Firmware	All versions
Netapp	Fas 8300 Firmware	All versions
Netapp	Fas 8700 Firmware	All versions
Netapp	H300e Firmware	All versions
Netapp	H300s Firmware	All versions
Netapp	H410s Firmware	All versions
Netapp	H500e Firmware	All versions
Netapp	H500s Firmware	All versions
Netapp	H700e Firmware	All versions
Netapp	H700s Firmware	All versions

References

Timeline

Published: May 3, 2022
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2022-1343?

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

How severe is CVE-2022-1343?

CVE-2022-1343 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 1.10% probability of exploitation in the next 30 days.

How do I fix CVE-2022-1343?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.