Vulnerability in OpenBSD Libressl
CVE-2022-48437
An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. x509_verify_ctx_add_chain does not store errors that occur during leaf certificate verification, and therefore an incorrect error is returned. This behavior occurs when there is an installed verification callback that instructs the verifier to continue upon detecting an invalid certificate.
Vulnerability class: Improper Certificate Validation
EPSS: 0.004 (28.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Openbsd Libressl
- Openbsd
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Patch)
- cve@mitre.org (Patch)
- cve@mitre.org (Patch)
Frequently asked questions
- What is CVE-2022-48437?
- CVE-2022-48437 is a medium-severity vulnerability in OpenBSD Libressl, classified under Improper Certificate Validation. CVSS score: 5.3/10. Published 2023-04-12.
- How severe is CVE-2022-48437?
- Medium severity. CVSS v3 base score is 5.3 out of 10.
- Is CVE-2022-48437 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.