Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-s6rb-rb8j-yfc6
Summary
Improper Certificate Validation
The function `OCSP_basic_verify` verifies the signer certificate on an OCSP response. In the case where the (non-default) flag OCSP_NOCHECKS is used then the response will be positive (meaning a successful verification) even in the case where the response signing certificate fails to verify. It is anticipated that most users of `OCSP_basic_verify` will not use the OCSP_NOCHECKS flag. In this case the `OCSP_basic_verify` function will return a negative value (indicating a fatal error) in the case of a certificate verification failure. The normal expected return value in this case would be 0. This issue also impacts the command line OpenSSL "ocsp" application. When verifying an ocsp response with the "-no_cert_checks" option the command line application will report that the verification is successful even though it has in fact failed. In this case the incorrect successful response will also be accompanied by error messages showing the failure and contradicting the apparently successful result. Fixed in OpenSSL 3.0.3 (Affected 3.0.0,3.0.1,3.0.2).
Aliases
0
alias CVE-2022-1343
1
alias GHSA-mfm6-r9g2-q4r7
Fixed_packages
0
url pkg:deb/debian/openssl@0?distro=trixie
purl pkg:deb/debian/openssl@0?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/openssl@0%3Fdistro=trixie
1
url pkg:deb/debian/openssl@1.1.1w-0%2Bdeb11u1?distro=trixie
purl pkg:deb/debian/openssl@1.1.1w-0%2Bdeb11u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-2hzz-tqgz-tbew
1
vulnerability VCID-ey1a-gmtq-6yct
2
vulnerability VCID-rgbt-w2ev-cfgw
3
vulnerability VCID-utdy-jcq5-w7g6
4
vulnerability VCID-xdsu-j1e8-ducr
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/openssl@1.1.1w-0%252Bdeb11u1%3Fdistro=trixie
2
url pkg:deb/debian/openssl@3.0.20-1~deb12u1?distro=trixie
purl pkg:deb/debian/openssl@3.0.20-1~deb12u1?distro=trixie
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-rgbt-w2ev-cfgw
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/openssl@3.0.20-1~deb12u1%3Fdistro=trixie
3
url pkg:deb/debian/openssl@3.5.6-1~deb13u1?distro=trixie
purl pkg:deb/debian/openssl@3.5.6-1~deb13u1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/openssl@3.5.6-1~deb13u1%3Fdistro=trixie
4
url pkg:deb/debian/openssl@3.6.2-1?distro=trixie
purl pkg:deb/debian/openssl@3.6.2-1?distro=trixie
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/openssl@3.6.2-1%3Fdistro=trixie
Affected_packages
0
url pkg:conan/openssl@3.0.0
purl pkg:conan/openssl@3.0.0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-1hgm-58xg-r7bt
1
vulnerability VCID-1yjs-f4gq-h7ht
2
vulnerability VCID-3g6n-ujyv-jub3
3
vulnerability VCID-5a2a-trbk-fkfg
4
vulnerability VCID-5rhg-tvzd-h7es
5
vulnerability VCID-86j5-ag2t-2qhj
6
vulnerability VCID-8q7w-7je3-zkgt
7
vulnerability VCID-97cm-wmq1-gkfd
8
vulnerability VCID-as38-bfar-q3hh
9
vulnerability VCID-erdm-7pfg-e7hc
10
vulnerability VCID-f2np-fk61-nbh1
11
vulnerability VCID-gj2m-z5b6-6yf2
12
vulnerability VCID-ju5y-bakm-mqd8
13
vulnerability VCID-m7sy-6spe-6yau
14
vulnerability VCID-mm8w-472m-puea
15
vulnerability VCID-mnkq-e45g-fyfw
16
vulnerability VCID-nqu1-ffyz-wubt
17
vulnerability VCID-nx5k-32hq-yuh4
18
vulnerability VCID-s6rb-rb8j-yfc6
19
vulnerability VCID-sd2f-6nk6-dua6
20
vulnerability VCID-se2f-3x6g-7uc6
21
vulnerability VCID-taas-512g-jfdw
22
vulnerability VCID-tjhj-1wc7-rych
23
vulnerability VCID-ts7c-u8g2-rqa4
24
vulnerability VCID-vyxk-cz2r-ffgf
25
vulnerability VCID-w1qj-n768-hbar
26
vulnerability VCID-yhn2-ctzh-ducy
resource_url http://public2.vulnerablecode.io/packages/pkg:conan/openssl@3.0.0
1
url pkg:rpm/redhat/openssl@1:3.0.1-41?arch=el9_0
purl pkg:rpm/redhat/openssl@1:3.0.1-41?arch=el9_0
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-3pke-7yer-87hz
1
vulnerability VCID-86j5-ag2t-2qhj
2
vulnerability VCID-erdm-7pfg-e7hc
3
vulnerability VCID-jfcp-evg4-8qd4
4
vulnerability VCID-s6rb-rb8j-yfc6
resource_url http://public2.vulnerablecode.io/packages/pkg:rpm/redhat/openssl@1:3.0.1-41%3Farch=el9_0
References
0
reference_url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1343.json
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
url https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-1343.json
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2022-1343
reference_id
reference_type
scores
0
value 0.00192
scoring_system epss
scoring_elements 0.40887
published_at 2026-06-04T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2022-1343
2
reference_url https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://cert-portal.siemens.com/productcert/pdf/ssa-953464.pdf
3
reference_url https://github.com/github/advisory-database/issues/405
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://github.com/github/advisory-database/issues/405
4
reference_url https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=2eda98790c5c2741d76d23cc1e74b0dc4f4b391a
5
reference_url https://rustsec.org/advisories/RUSTSEC-2022-0027.html
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://rustsec.org/advisories/RUSTSEC-2022-0027.html
6
reference_url https://security.netapp.com/advisory/ntap-20220602-0009
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://security.netapp.com/advisory/ntap-20220602-0009
7
reference_url https://www.openssl.org/news/secadv/20220503.txt
reference_id
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://www.openssl.org/news/secadv/20220503.txt
8
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=2087911
reference_id 2087911
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=2087911
9
reference_url https://nvd.nist.gov/vuln/detail/CVE-2022-1343
reference_id CVE-2022-1343
reference_type
scores
0
value 5.3
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
1
value MODERATE
scoring_system generic_textual
scoring_elements
url https://nvd.nist.gov/vuln/detail/CVE-2022-1343
10
reference_url https://access.redhat.com/errata/RHSA-2022:6224
reference_id RHSA-2022:6224
reference_type
scores
url https://access.redhat.com/errata/RHSA-2022:6224
Weaknesses
0
cwe_id 1035
name OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017.
1
cwe_id 295
name Improper Certificate Validation
description The product does not validate, or incorrectly validates, a certificate.
2
cwe_id 937
name OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
description Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013.
Exploits
Severity_range_score4.0 - 6.9
Exploitability0.5
Weighted_severity6.2
Risk_score3.1
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-s6rb-rb8j-yfc6