{"id":"RUSTSEC-2022-0027","revision":"202810ff17344cc3be18680b34c76b57","records":[{"revision":"202810ff17344cc3be18680b34c76b57","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2022-0027","aliases":["CVE-2022-1343","GHSA-mfm6-r9g2-q4r7"],"title":"`OCSP_basic_verify` may incorrectly verify the response signing certificate","description":"The function `OCSP_basic_verify` verifies the signer certificate on an OCSP\nresponse. In the case where the (non-default) flag OCSP_NOCHECKS is used then\nthe response will be positive (meaning a successful verification) even in the\ncase where the response signing certificate fails to verify.\n\nIt is anticipated that most users of `OCSP_basic_verify` will not use the\nOCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return\na negative value (indicating a fatal error) in the case of a certificate\nverification failure. The normal expected return value in this case would be 0.","state":0,"publishedAt":"2022-05-03T12:00:00+00:00","modifiedAt":"2023-11-08T04:07:47.512143+00:00","affected":[{"ecosystem":"crates.io","name":"openssl-src","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"300.0.0"},{"kind":"fixed","version":"300.0.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":null,"severity":null}],"references":["https://crates.io/crates/openssl-src","https://rustsec.org/advisories/RUSTSEC-2022-0027.html","https://www.openssl.org/news/secadv/20220503.txt"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2022-0027","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2022-0027","identifiers":["RUSTSEC-2022-0027","CVE-2022-1343","GHSA-mfm6-r9g2-q4r7"]},"retained":false,"historicalAffected":[]}],"coverage":[]}