---
title: "CVE-2022-4203\n    | Ubuntu"
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2022-4203?format=md
keywords: index, follow
---

# CVE-2022-4203

Publication date 7 February 2023

Last updated 4 August 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

## Cvss 3 Severity Score

**4.9 · Medium**

[Score breakdown](https://ubuntu.com/security/CVE-2022-4203?format=md#impact-score)

Toggle side navigation

## Description

A read buffer overrun can be triggered in X.509 certificate verification,
specifically in name constraint checking. Note that this occurs
after certificate chain signature verification and requires either a
CA to have signed the malicious certificate or for the application to
continue certificate verification despite failure to construct a path
to a trusted issuer.
The read buffer overrun might result in a crash which could lead to
a denial of service attack. In theory it could also result in the
disclosure
of private memory contents (such as private keys, or sensitive plaintext)
although we are not aware of any working exploit leading to memory
contents disclosure as of the time of release of this advisory.
In a TLS client, this can be triggered by connecting to a malicious
server. In a TLS server, this can be triggered if the server requests
client authentication and a malicious client connects.

[Read the notes from the security team](https://ubuntu.com/security/CVE-2022-4203?format=md#notes)

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| edk2 | 23.10 mantic | Not affected |
| 23.04 lunar | Not affected |
| 22.10 kinetic | Not affected |
| 22.04 LTS jammy | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Ignored end of standard support |
| nodejs | 23.10 mantic | Not affected |
| 23.04 lunar | Not affected |
| 22.10 kinetic | Not affected |
| 22.04 LTS jammy | Not affected |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |
| openssl | 23.10 mantic | Fixed 3.0.8-1ubuntu1 |
| 23.04 lunar | Fixed 3.0.8-1ubuntu1 |
| 22.10 kinetic | Fixed 3.0.5-2ubuntu2.1 |
| 22.04 LTS jammy | Fixed 3.0.2-0ubuntu1.8 |
| 20.04 LTS focal | Not affected |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not affected |
| 14.04 LTS trusty | Not affected |
| openssl1.0 | 22.10 kinetic | Not in release |
| 22.04 LTS jammy | Not in release |
| 20.04 LTS focal | Not in release |
| 18.04 LTS bionic | Not affected |
| 16.04 LTS xenial | Not in release |
| 14.04 LTS trusty | Not in release |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## Notes

---

### [mdeslaur](https://launchpad.net/~mdeslaur)

3.x only

## Severity score breakdown

CVSS version:
CVSS v3.0

**Base score**

4.9 · Medium

* Base metrics

  | Parameter | Value |
  | --- | --- |
  | Attack vector | Network |
  | Attack complexity | Low |
  | Privileges required | High |
  | User interaction | None |
  | Scope | Unchanged |
  | Confidentiality impact | None |
  | Integrity impact | None |
  | Availability impact | High |
* Scores

  | Parameter | Value |
  | --- | --- |
  | Base score | 4.9 · Medium |
  | Exploitability score | - |
  | Impact score | - |

**Vector:** CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4203)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2022-4203)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2022-4203)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2022-4203)

### Related Ubuntu Security Notices (USN)

+ [USN-5844-1](https://usn.ubuntu.com/USN-5844-1)
+ OpenSSL vulnerabilities
+ 7 February 2023

### Other references

* <https://www.openssl.org/news/secadv/20230207.txt>
* <https://www.cve.org/CVERecord?id=CVE-2022-4203>