CWE-599
Missing Validation of OpenSSL Certificate
AI Translation Available
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Status
incomplete
Abstraction
variant
Affected Platforms
Technical Details
AI Translation
Common Consequences
confidentiality
access control
Impacts
read application data
bypass protection mechanism
gain privileges or assume identity
Potential Mitigations
Phases:
architecture and design
implementation
Descriptions:
•
Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
•
Ensure that proper authentication is included in the system design.