793
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 672 Operation on a Resource after Expiration or Release 1479
PeerOf 298 Improper Validation of Certificate Expiration 726
PeerOf 262 Not Using Password Aging 633
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1013 Encrypt Data 2428
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 255 Credentials Management Errors 2315
MemberOf 310 Cryptographic Issues 2318
MemberOf 320 Key Management Errors 2319
Applicable Platforms
Language : Not Language-Specific (Prevalence = Undetermined)
Likelihood Of Exploit
Low
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
Gain Privileges or Assume Identity
The cryptographic key in question may be compromised,
providing a malicious user with a method for authenticating
as the victim.
Potential Mitigations
Phase: Architecture and Design
Adequate consideration should be put in to the user interface in order to notify users previous to
the key's expiration, to explain the importance of new key generation and to walk users through
the process as painlessly as possible.
Demonstrative Examples
Example 1:
The following code attempts to verify that a certificate is valid.
Example Language: C (Bad)
if (cert = SSL_get_peer_certificate(ssl)) {
foo=SSL_get_verify_result(ssl);
if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo))
//do stuff
}
The code checks if the certificate is not yet valid, but it fails to check if a certificate is past its
expiration date, thus treating expired certificates as valid.
Observed Examples
CWE Version 4.14
CWE-325: Missing Cryptographic Step
CWE-325: Missing Cryptographic Step