CWE-599
Missing Validation of OpenSSL Certificate
AI Translation Available
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Status
incomplete
Abstraction
variant
Affected Platforms
Extended Description
AI Translation
This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated.
Technical Details
AI Translation
Common Consequences
confidentiality
access control
Impacts
read application data
bypass protection mechanism
gain privileges or assume identity
Potential Mitigations
Phases:
architecture and design
implementation
Descriptions:
•
Ensure that proper authentication is included in the system design.
•
Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.