717
If the call to SSL_get_verify_result() returns X509_V_ERR_CERT_HAS_EXPIRED, this means
that the certificate has expired. As time goes on, there is an increasing chance for attackers to
compromise the certificate.
Example 4:
The following OpenSSL code ensures that there is a certificate before continuing execution.
Example Language: C (Bad)
if (cert = SSL_get_peer_certificate(ssl)) {
// got a certificate, do secret things
Because this code does not use SSL_get_verify_results() to check the certificate, it could accept
certificates that have been revoked (X509_V_ERR_CERT_REVOKED). The software could be
communicating with a malicious host.
Example 5:
The following OpenSSL code ensures that the host has a certificate.
Example Language: C (Bad)
if (cert = SSL_get_peer_certificate(ssl)) {
// got certificate, host can be trusted
//foo=SSL_get_verify_result(ssl);
//if (X509_V_OK==foo) ...
}
Note that the code does not call SSL_get_verify_result(ssl), which effectively disables the validation
step that checks the certificate.
Observed Examples
Reference Description
CVE-2019-12496 A Go framework for robotics, drones, and IoT devices skips verification of root
CA certificates by default.
https://www.cve.org/CVERecord?id=CVE-2019-12496
CVE-2014-1266 chain: incorrect "goto" in Apple SSL product bypasses certificate validation,
allowing Adversary-in-the-Middle (AITM) attack (Apple "goto fail" bug).
CWE-705 (Incorrect Control Flow Scoping) -> CWE-561 (Dead Code) ->
CWE-295 (Improper Certificate Validation) -> CWE-393 (Return of Wrong
Status Code) -> CWE-300 (Channel Accessible by Non-Endpoint).
https://www.cve.org/CVERecord?id=CVE-2014-1266
CVE-2021-22909 Chain: router's firmware update procedure uses curl with "-k" (insecure) option
that disables certificate validation (CWE-295), allowing adversary-in-the-middle
(AITM) compromise with a malicious firmware image (CWE-494).
https://www.cve.org/CVERecord?id=CVE-2021-22909
CVE-2008-4989 Verification function trusts certificate chains in which the last certificate is selfsigned.
https://www.cve.org/CVERecord?id=CVE-2008-4989
CVE-2012-5821 Web browser uses a TLS-related function incorrectly, preventing it from
verifying that a server's certificate is signed by a trusted certification authority
(CA)
https://www.cve.org/CVERecord?id=CVE-2012-5821
CVE-2009-3046 Web browser does not check if any intermediate certificates are revoked.
https://www.cve.org/CVERecord?id=CVE-2009-3046
CVE-2011-0199 Operating system does not check Certificate Revocation List (CRL) in some
cases, allowing spoofing using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2011-0199
CWE Version 4.14
CWE-295: Improper Certificate Validation
CWE-295: Improper Certificate Validation