721
foo=SSL_get_verify_result(ssl);
if ((X509_V_OK==foo) || X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN==foo))
// certificate looks good, host can be trusted
In this case, because the certificate is self-signed, there was no external authority that could
prove the identity of the host. The program could be communicating with a different system that is
spoofing the host, e.g. by poisoning the DNS cache or using an Adversary-in-the-Middle (AITM)
attack to modify the traffic from server to client.
Observed Examples
Reference Description
CVE-2016-2402 Server allows bypass of certificate pinning by sending a chain of trust that
includes a trusted CA that is not pinned.
https://www.cve.org/CVERecord?id=CVE-2016-2402
CVE-2008-4989 Verification function trusts certificate chains in which the last certificate is selfsigned.
https://www.cve.org/CVERecord?id=CVE-2008-4989
CVE-2012-5821 Chain: Web browser uses a TLS-related function incorrectly, preventing it from
verifying that a server's certificate is signed by a trusted certification authority
(CA).
https://www.cve.org/CVERecord?id=CVE-2012-5821
CVE-2009-3046 Web browser does not check if any intermediate certificates are revoked.
https://www.cve.org/CVERecord?id=CVE-2009-3046
CVE-2009-0265 chain: DNS server does not correctly check return value from the OpenSSL
EVP_VerifyFinal function allows bypass of validation of the certificate chain.
https://www.cve.org/CVERecord?id=CVE-2009-0265
CVE-2009-0124 chain: incorrect check of return value from the OpenSSL EVP_VerifyFinal
function allows bypass of validation of the certificate chain.
https://www.cve.org/CVERecord?id=CVE-2009-0124
CVE-2002-0970 File-transfer software does not validate Basic Constraints of an intermediate
CA-signed certificate.
https://www.cve.org/CVERecord?id=CVE-2002-0970
CVE-2002-0862 Cryptographic API, as used in web browsers, mail clients, and other software,
does not properly validate Basic Constraints.
https://www.cve.org/CVERecord?id=CVE-2002-0862
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 724 OWASP Top Ten 2004 Category A3 - Broken
Authentication and Session Management
711 2335
MemberOf 884 CWE Cross-section 884 2567
MemberOf 948 SFP Secondary Cluster: Digital Certificate 888 2395
MemberOf 1346 OWASP Top Ten 2021 Category A02:2021 -
Cryptographic Failures
1344 2488
MemberOf 1382 ICS Operations (& Maintenance): Emerging Energy
Technologies
1358 2517
MemberOf 1396 Comprehensive Categorization: Access Control 1400 2519
Taxonomy Mappings
CWE Version 4.14
CWE-297: Improper Validation of Certificate with Host Mismatch
CWE-297: Improper Validation of Certificate with Host Mismatch