# CVE-2022-1343: openssl: OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as... CVE-2022-1343 is fixed in 8 products on 1 platform, first by libssl3 3.0.2-0ubuntu1.1, released May 2, 2022. It is not reported as exploited. Patch Radar priority: Routine. - Web page: https://patchblox.com/security/cve/CVE-2022-1343 - Priority: Routine - CVSS: 5.3 (Moderate) - EPSS: 0.0216 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: May 2, 2022 ## Description OpenSSL is a toolkit that implements the Secure Sockets Layer (SSL) and Transport Layer Security (TLS) protocols, as well as a full-strength general-purpose cryptography library. Security Fix(es): * openssl: c_rehash script allows command injection (CVE-2022-1292) * openssl: Signer certificate verification returns inaccurate response when using OCSP_NOCHECKS (CVE-2022-1343) * openssl: OPENSSL_LH_flush() breaks reuse of memory (CVE-2022-1473) * openssl: the c_rehash script allows command injection (CVE-2022-2068) * openssl: AES OCB fails to encrypt some bytes (CVE-2022-2097) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * openssl occasionally sends internal error to gnutls when using FFDHE (BZ#2080323) * openssl req defaults to 3DES (BZ#2085499) * OpenSSL accepts custom elliptic curve parameters when p is large [rhel-9] (BZ#2085508) * OpenSSL mustn't work with ECDSA with explicit curve parameters in FIPS mode (BZ#2085521) * openssl s_server -groups secp256k1 in FIPS fails because X25519/X448 (BZ#2086554) * Converting FIPS power-on self test to KAT (BZ#2086866) * Small RSA keys work for some operations in FIPS mode (BZ#2091938) * FIPS provider doesn't block RSA encryption for key transport (BZ#2091977) * OpenSSL testsuite certificates expired (BZ#2095696) * [IBM 9.1 HW OPT] POWER10 performance enhancements for cryptography: OpenSSL (BZ#2103044) * [FIPS lab review] self-test (BZ#2112978) * [FIPS lab review] DH tuning (BZ#2115856) * [FIPS lab review] EC tuning (BZ#2115857) * [FIPS lab review] RSA tuning (BZ#2115858) * [FIPS lab review] RAND tuning (BZ#2115859) * [FIPS lab review] zeroization (BZ#2115861) * [FIPS lab review] HKDF limitations (BZ#2118388) ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | libssl3 Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.1 | [libssl3 3.0.2-0ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-libssl3-3.0.2-0ubuntu1.1.md) | May 2, 2022 | | Linux | openssl RHEL 9 | 1:3.0.1-41.el9_0 | [RHSA-2022:6224](https://patchblox.com/security/data/fix/linux/rhsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl Ubuntu 22.04.1 LTS (jammy) | 3.0.2-0ubuntu1.1 | [openssl 3.0.2-0ubuntu1.1](https://patchblox.com/security/data/fix/linux/ubuntu-jammy-openssl-3.0.2-0ubuntu1.1.md) | May 2, 2022 | | Linux | openssl almalinux 9 | 1:3.0.1-41.el9_0 | [ALSA-2022:6224](https://patchblox.com/security/data/fix/linux/alsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl ol 9 | 2:3.0.1-41.0.1.ksplice1.el9_0 | [ELSA-2022-9751](https://patchblox.com/security/data/fix/linux/elsa-2022-9751.md) | Aug 31, 2022 | | Linux | openssl-debuginfo amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-debugsource amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-devel RHEL 9 | 1:3.0.1-41.el9_0 | [RHSA-2022:6224](https://patchblox.com/security/data/fix/linux/rhsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-devel almalinux 9 | 1:3.0.1-41.el9_0 | [ALSA-2022:6224](https://patchblox.com/security/data/fix/linux/alsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-devel amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-devel ol 9 | 2:3.0.1-41.0.1.ksplice1.el9_0 | [ELSA-2022-9751](https://patchblox.com/security/data/fix/linux/elsa-2022-9751.md) | Aug 31, 2022 | | Linux | openssl-libs RHEL 9 | 1:3.0.1-41.el9_0 | [RHSA-2022:6224](https://patchblox.com/security/data/fix/linux/rhsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-libs almalinux 9 | 1:3.0.1-41.el9_0 | [ALSA-2022:6224](https://patchblox.com/security/data/fix/linux/alsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-libs amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-libs ol 9 | 2:3.0.1-41.0.1.ksplice1.el9_0 | [ELSA-2022-9751](https://patchblox.com/security/data/fix/linux/elsa-2022-9751.md) | Aug 31, 2022 | | Linux | openssl-libs-debuginfo amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-perl RHEL 9 | 1:3.0.1-41.el9_0 | [RHSA-2022:6224](https://patchblox.com/security/data/fix/linux/rhsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-perl almalinux 9 | 1:3.0.1-41.el9_0 | [ALSA-2022:6224](https://patchblox.com/security/data/fix/linux/alsa-2022-6224.md) | Aug 30, 2022 | | Linux | openssl-perl amzn 2023 | 1:3.0.5-1.amzn2023.0.4 | [ALAS2023-2023-051](https://patchblox.com/security/data/fix/linux/alas2023-2023-051.md) | Feb 17, 2023 | | Linux | openssl-perl ol 9 | 2:3.0.1-41.0.1.ksplice1.el9_0 | [ELSA-2022-9751](https://patchblox.com/security/data/fix/linux/elsa-2022-9751.md) | Aug 31, 2022 | --- Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.