Improper Certificate Validation
CVE-2022-1343
Summary
The function 'OCSP_basic_verify' verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then, the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of 'OCSP_basic_verify' will not use the OCSP_NOCHECKS flag. In this case, the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case, would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case, the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. This issue affects versions 3.0.0-alpha1 through 3.0.2.
- LOW
- NETWORK
- LOW
- UNCHANGED
- NONE
- NONE
- NONE
- NONE
CWE-295 - Improper Certificate Validation
The authenticity component of a web system stems from the ability to validate “Digital certificates”, which (i) establish trust between two or more entities sharing data over a network; (ii) ensure data at rest and transit is secure from unauthorized access; and (iii) check the identity of the actors that interact with the system. An application with absent or ineffective certificate validation mechanisms allows malicious users, impersonating trusted hosts, to manipulate the communication path between the client and the host, resulting in unauthorized access to data and to the application’s internal environment, and potentially enabling man-in-the-middle attacks.
Advisory Timeline
- Published
