CVE-2022-43705 Security feature bypass in n/a

Critical 9.1 Published 27 Nov 2022 Updated 25 Apr 2025

Attackers can forge OCSP responses due to a certificate verification error in the Botan library, bypassing revocation checks.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2022-43705?

CVE-2022-43705 is a critical vulnerability in n/a, published on 27 Nov 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Botan before 2.19.3, it is possible to forge OCSP responses due to a certificate verification error. This issue was introduced in Botan 1.11.34 (November 2016).

Weakness: CWE-295

Which versions are affected by CVE-2022-43705?

It affects 1 product.

Linux distribution packages (5)

`Botan` SUSE:Package Hub 15 SP3	All versions	`2.10.0-bp153.3.3.1`
`Botan` SUSE:Package Hub 15 SP4	All versions	`2.18.2-bp154.2.3.1`
`Botan` openSUSE:Leap 15.3	All versions	`2.10.0-bp153.3.3.1`
`Botan` openSUSE:Leap 15.4	All versions	`2.18.2-bp154.2.3.1`
`Botan` openSUSE:Tumbleweed	All versions	`2.19.3-1.1`

Products include Botan Project Botan.

How do I fix CVE-2022-43705?

Upgrade to a fixed version.

Is CVE-2022-43705 being exploited?

There is no known exploitation of CVE-2022-43705 in the wild and no public exploit code.

Sources

Also known as AZL-44751, DEBIAN-CVE-2022-43705, GHSA-4v9w-qvcq-6q7w, MGASA-2022-0445, UBUNTU-CVE-2022-43705, openSUSE-SU-2022:10210-1 and 2 more.