Unknown
CVE-2022-1343
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
Add References:
CVE-2022-1343
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Topic Tags
Description
The function OCSP_basic_verify verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of OCSP_basic_verify will not use the OCSP_NOCHECKS flag. In this case the OCSP_basic_verify function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL “ocsp” application. When verifying an ocsp response with the “-no_cert_checks” option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Add Assessment
No one has assessed this topic. Be the first to add your voice to the community.
CVSS V3 Severity and Metrics
General Information
Vendors
- netapp,
- openssl
Products
- a250 firmware -,
- a700s firmware -,
- active iq unified manager -,
- aff 500f firmware -,
- aff 8300 firmware -,
- aff 8700 firmware -,
- aff a400 firmware -,
- clustered data ontap -,
- clustered data ontap antivirus connector -,
- fabric-attached storage a400 firmware -,
- fas 500f firmware -,
- fas 8300 firmware -,
- fas 8700 firmware -,
- h300e firmware -,
- h300s firmware -,
- h410s firmware -,
- h500e firmware -,
- h500s firmware -,
- h700e firmware -,
- h700s firmware -,
- openssl,
- santricity smi-s provider -,
- smi-s provider -,
- snapmanager -,
- solidfire & hci management node -,
- solidfire, enterprise sds & hci storage node -
References
Additional Info
Technical Analysis
Report as Exploited in the Wild
CVE ID
AttackerKB requires a CVE ID in order to pull vulnerability data and references from the CVE list and the National Vulnerability Database. If available, please supply below:
