726
CWE-298: Improper Validation of Certificate Expiration
Weakness ID : 298
Structure : Simple
Abstraction : Variant
Description
A certificate expiration is not validated or is incorrectly validated, so trust may be assigned to
certificates that have been abandoned due to age.
Extended Description
When the expiration of a certificate is not taken into account, no trust has necessarily been
conveyed through it. Therefore, the validity of the certificate cannot be verified and all benefit of the
certificate is lost.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 672 Operation on a Resource after Expiration or Release 1479
ChildOf 295 Improper Certificate Validation 714
PeerOf 324 Use of a Key Past its Expiration Date 792
PeerOf 370 Missing Check for Certificate Revocation after Initial Check 917
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1014 Identify Actors 2429
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Integrity
Other
Other
The data read from the system vouched for by the expired
certificate may be flawed due to malicious spoofing.
Authentication
Other
Other
Trust afforded to the system in question - based on the
expired certificate - may allow for spoofing attacks.
Potential Mitigations
Phase: Architecture and Design
Check for expired certificates and provide the user with adequate information about the nature of
the problem and how to proceed.
Phase: Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully
validated before the certificate is pinned, including the expiration.
CWE Version 4.14
CWE-299: Improper Check for Certificate Revocation
CWE-299: Improper Check for Certificate Revocation