CVE-2022-43705

2022-11-2704:15:10

Debian Security Bug Tracker

security-tracker.debian.org

botan

ocsp

certificate verification

forgery

cve-2022-43705

unix

9.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

0.001 Low

EPSS

Percentile

39.5%

JSON

In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).

OSVersionArchitecturePackageVersionFilename
Debian12allbotan< 2.19.3+dfsg-1botan_2.19.3+dfsg-1_all.deb
Debian11allbotan<= 2.17.3+dfsg-2botan_2.17.3+dfsg-2_all.deb
Debian999allbotan< 2.19.3+dfsg-1botan_2.19.3+dfsg-1_all.deb
Debian13allbotan< 2.19.3+dfsg-1botan_2.19.3+dfsg-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	botan	< 2.19.3+dfsg-1	botan_2.19.3+dfsg-1_all.deb
Debian	11	all	botan	<= 2.17.3+dfsg-2	botan_2.17.3+dfsg-2_all.deb
Debian	999	all	botan	< 2.19.3+dfsg-1	botan_2.19.3+dfsg-1_all.deb
Debian	13	all	botan	< 2.19.3+dfsg-1	botan_2.19.3+dfsg-1_all.deb