Vulnerability Description
In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
CVSS Score
9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Botan Project | Botan | >= 1.11.34, < 2.19.3 |
Related Weaknesses (CWE)
References
- https://github.com/randombit/botan/releases/tag/2.19.3Release NotesThird Party Advisory
- https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7wMitigationThird Party Advisory
- https://github.com/randombit/botan/releases/tag/2.19.3Release NotesThird Party Advisory
- https://github.com/randombit/botan/security/advisories/GHSA-4v9w-qvcq-6q7wMitigationThird Party Advisory
FAQ
What is CVE-2022-43705?
CVE-2022-43705 is a vulnerability with a CVSS score of 9.1 (CRITICAL). In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).
How severe is CVE-2022-43705?
CVE-2022-43705 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-43705?
Check the references section above for vendor advisories and patch information. Affected products include: Botan Project Botan.