CVE-2022-43705 — Improper Certificate Validation in Project Botan

CWE-295 — Improper Certificate Validation3 documents3 sources
Severity
9.1CRITICALNVD
EPSS
0.2%
top 62.66%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Botan Project BotanDebian Botan
Timeline
PublishedNov 27

Description

In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 3.9 | Impact: 5.2

Affected Packages3 packages

▶debiandebian/botan< botan 2.19.3+dfsg-1 (bookworm)
▶NVDbotan_project/botan1.11.34 — 2.19.3
▶Debianbotan_project/botan< 2.19.3+dfsg-1+1

🔴Vulnerability Details

1
OSV
CVE-2022-43705: In Botan before 2↗2022-11-27
▶

📋Vendor Advisories

1
Debian
CVE-2022-43705: botan - In Botan before 2.19.3, it is possible to forge OCSP responses due to a certific...↗2022
▶