OCSP_basic_verify may incorrectly verify the response signing certificate

Vulnerability

The function OCSP_basic_verify in OpenSSL versions 3.0.0, 3.0.1, and 3.0.2 incorrectly handles the non-default OCSP_NOCHECKS flag. When this flag is set, the function returns a positive result (indicating successful verification) even when the response signing certificate fails to verify. The command line ocsp application with the "-no_cert_checks" option is similarly affected. [1][2]

Exploitation

An attacker does not need authentication or special network position. To trigger the bug, the OCSP verifying application must explicitly pass the OCSP_NOCHECKS flag to OCSP_basic_verify, or the OCSP command must be invoked with the "-no_cert_checks" option. When that non-default flag is used, the function returns a success indicator despite the underlying certificate validation failure. The responsible code path is reachable without user interaction. [1][2]

Impact

A successful exploitation causes the OCSP response verification to incorrectly report success. This can lead to acceptance of an invalid or malicious OCSP response, undermining certificate revocation checks. The impact is on integrity, as a failed verification is reported as successful, potentially allowing a revoked or unauthorized certificate to be accepted. No confidentiality or availability impact is described. [1][2]

Mitigation

OpenSSL 3.0.3, released on 3 May 2022, fixes this vulnerability. Users of affected OpenSSL 3.0.0 through 3.0.2 should upgrade to 3.0.3. For the Rust openssl-src crate, versions >= 300.0.6 contain the fix, while versions prior to 300.0 are unaffected. The default code paths (without the OCSP_NOCHECKS flag) are not vulnerable. [1][2][4]