OpenSSL Vulnerability: OCSP Basic Verification Flaw in Package OpenSSL
Summary
UBUNTU-CVE-2022-1343: The function OCSP_basic_verify verifies the signer certificate on an OCSP response. Affects openssl versions < 3.0.2-0ubuntu1.1. Fixed in 3.0.2-0ubuntu1.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenSSL is a widely-used open-source software library that provides robust cryptographic functions and protocols, including secure communication over networks. It is essential for implementing SSL and TLS protocols, ensuring data integrity and confidentiality. The vulnerability in question affects the OCSP (Online Certificate Status Protocol) verification process, which is critical for validating the status of digital certificates.
Vulnerability Detail
The vulnerability arises from the OCSP_basic_verify function, which incorrectly verifies the signer certificate on an OCSP response when the OCSP_NOCHECKS flag is used. This flaw can lead to a false positive verification result, indicating a successful validation even when the signing certificate fails to verify. This issue not only affects the OpenSSL library but also the command line OpenSSL 'ocsp' application, which may report successful verification alongside error messages, creating confusion and potential security risks.
How To Fix
Minimum fixed version
3.0.2-0ubuntu1.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade opensslTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users are advised to avoid using the OCSP_NOCHECKS flag when calling the OCSP_basic_verify function. Additionally, refrain from using the '-no_cert_checks' option in the command line OpenSSL 'ocsp' application to prevent misleading verification results.
Conclusion
In summary, the OpenSSL vulnerability related to the OCSP basic verification process poses significant risks by potentially allowing false positive certificate validations. Users are encouraged to update to the latest patched version to mitigate these risks and ensure secure communications.
See every vulnerability recorded for openssl →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a medium severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential risks include false verification of certificates, leading to unauthorized access or data breaches due to reliance on incorrect validation results.
Yes, OpenSSL version 3.0.3 and later versions have addressed this vulnerability and are safe to use.
If an immediate update is not possible, avoid using the OCSP_NOCHECKS flag and the '-no_cert_checks' option to minimize the risk of false verifications.
Related vulnerabilities
Recent vulnerabilities recorded for openssl.
