CVE-2022-1343

CVE-2022-1343 is a vulnerability in OpenSSL versions 3.0.0 through 3.0.2, affecting the OCSP_basic_verify function. When the non-default OCSP_NOCHECKS flag is used, this function incorrectly reports a successful verification of an OCSP response even if the signer certificate verification fails. This issue also impacts the OpenSSL "ocsp" command-line application when using the "-no_cert_checks" option. The vulnerability has a CVSS v3.1 score of 5.3 (Medium), indicating a network-based attack with low complexity and no user interaction required, leading to a potential integrity impact. The primary concern is that an application might incorrectly trust a compromised OCSP response. Currently, there is no evidence of active exploitation, nor are there publicly available exploit codes in Metasploit, Nuclei, or ExploitDB. Community discussion is minimal, with only one mention identified, and there is no media coverage.