CVE-2022-1343 | OCSP_basic_verify may incorrectly verify the response signing certificate

The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).

Published: 2022-05-03 Last update: 2025-05-05 Assigner: [email protected] Source: [email protected]

Conclusion & alert: CVE-2022-1343 is rated Low Risk (35.4/100): CVSS Medium severity, with low exploitation likelihood (EPSS 0.19%). Mandatory action: Monitor for updates and reassess as exploit intelligence or EPSS changes.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2022-1343

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-05-18 0.25% 0.19% -0.06%
2 2026-04-20 0.11% 0.25% +0.14%
3 2025-03-30 0.11%

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2022-1343

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
3.9 1.4 [email protected]
5.3 3.1 MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:L)
Attackers could change some data, but it’s limited—not everything goes.
Availability (A:N)
Service keeps running; no real outage angle.
3.9 1.4 134c704f-9b21-4f2e-91b3-4a467353bcc0
4.3 2.0 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N Click to expand
Access vector (AV:N)
Can be exploited remotely over network reachability.
Access complexity (AC:M)
Exploitation needs some favorable conditions, but not exceptional ones.
Authentication (AU:N)
No authentication is required.
Confidentiality impact (C:N)
No confidentiality impact.
Integrity impact (I:P)
Partial integrity impact.
Availability impact (A:N)
No availability impact.
8.6 2.9 [email protected]

Weakness enumeration for CVE-2022-1343

GitHub Security Advisory for CVE-2022-1343

GHSA-mfm6-r9g2-q4r7 · Severity: medium · Ecosystem: rust — `OCSP_basic_verify` may incorrectly verify the response signing certificate

OS Trackers for CVE-2022-1343

vendor priority summary link
alpine CVE-2022-1343: 2 source package rows (openssl, openssl3); 18 state rows across 7 repos (3.17-main, 3.18-main, 3.19-main, 3.20-main, 3.21-main, 3.22-main, edge-main); fixed 8, open 10. https://security.alpinelinux.org/vuln/CVE-2022-1343
debian unimportant CVE-2022-1343 unimportant priority: Debian including 1 source packages (openssl), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. https://security-tracker.debian.org/tracker/CVE-2022-1343
redhat medium https://access.redhat.com/security/cve/CVE-2022-1343
suse medium CVE-2022-1343 severity moderate: SUSE including 69 source package names (compat-openssl098, libopenssl-1_0_0-devel, …), 407 product×package rows across 59 product lines (HPE Helion OpenStack 8, SUSE CaaS Platform 4.0, … (59 product lines)): Known Not Affected 355, Fixed 52. https://www.suse.com/security/cve/CVE-2022-1343/
ubuntu medium CVE-2022-1343 medium priority: Ubuntu including 4 source packages (edk2, nodejs, openssl, openssl1.0), 44 status rows across 11 suites (bionic, focal, impish, jammy, kinetic, lunar, mantic, noble, trusty, upstream, xenial): not-affected 25, DNE 10, released 7, needs-triage 2. https://ubuntu.com/security/CVE-2022-1343

Affected software / configurations for CVE-2022-1343

Vendor Product Version Raw CPE
openssl openssl >= 3.0.0, < 3.0.3 cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*
netapp active_iq_unified_manager cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vsphere:*:*
netapp clustered_data_ontap cpe:2.3:a:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*
netapp clustered_data_ontap_antivirus_connector cpe:2.3:a:netapp:clustered_data_ontap_antivirus_connector:-:*:*:*:*:*:*:*
netapp santricity_smi-s_provider cpe:2.3:a:netapp:santricity_smi-s_provider:-:*:*:*:*:*:*:*
netapp smi-s_provider cpe:2.3:a:netapp:smi-s_provider:-:*:*:*:*:*:*:*
netapp snapmanager cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:hyper-v:*:*
netapp solidfire\,_enterprise_sds_\&_hci_storage_node cpe:2.3:a:netapp:solidfire\,_enterprise_sds_\&_hci_storage_node:-:*:*:*:*:*:*:*
netapp solidfire_\&_hci_management_node cpe:2.3:a:netapp:solidfire_\&_hci_management_node:-:*:*:*:*:*:*:*
netapp a250_firmware cpe:2.3:o:netapp:a250_firmware:-:*:*:*:*:*:*:*
netapp a700s_firmware cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
netapp aff_500f_firmware cpe:2.3:o:netapp:aff_500f_firmware:-:*:*:*:*:*:*:*
netapp aff_8300_firmware cpe:2.3:o:netapp:aff_8300_firmware:-:*:*:*:*:*:*:*
netapp aff_8700_firmware cpe:2.3:o:netapp:aff_8700_firmware:-:*:*:*:*:*:*:*
netapp aff_a400_firmware cpe:2.3:o:netapp:aff_a400_firmware:-:*:*:*:*:*:*:*
netapp fabric-attached_storage_a400_firmware cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*
netapp fas_500f_firmware cpe:2.3:o:netapp:fas_500f_firmware:-:*:*:*:*:*:*:*
netapp fas_8300_firmware cpe:2.3:o:netapp:fas_8300_firmware:-:*:*:*:*:*:*:*
netapp fas_8700_firmware cpe:2.3:o:netapp:fas_8700_firmware:-:*:*:*:*:*:*:*
netapp h300e_firmware cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
netapp h300s_firmware cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
netapp h410s_firmware cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
netapp h500e_firmware cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
netapp h500s_firmware cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
netapp h700e_firmware cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
netapp h700s_firmware cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

References for CVE-2022-1343

cvelogic Threat Intelligence