1331
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding MEM06-
C
Ensure that sensitive data is not written
out to disk
Software Fault Patterns SFP23 Exposed Data
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL
Objects are Created
Weakness ID : 593
Structure : Simple
Abstraction : Variant
Description
The product modifies the SSL context after connection creation has begun.
Extended Description
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the
possibility that older SSL objects created from the original context could all be affected by that
change.
Relationships
The table(s) below shows the weaknesses and high level categories that are related to this
weakness. These relationships are defined as ChildOf, ParentOf, MemberOr and give insight to
similar items that may exist at higher and lower levels of abstraction. In addition, relationships such
as PeerOf and CanAlsoBe are defined to show similar weaknesses that may want to be explored.
Relevant to the view "Research Concepts" (CWE-1000)
Nature Type ID Name Page
ChildOf 1390 Weak Authentication 2267
ChildOf 666 Operation on Resource in Wrong Phase of Lifetime 1462
Relevant to the view "Architectural Concepts" (CWE-1008)
Nature Type ID Name Page
MemberOf 1010 Authenticate Actors 2424
Common Consequences
Scope Impact Likelihood
Access Control Bypass Protection Mechanism
No authentication takes place in this process, bypassing
an assumed protection of encryption.
Confidentiality Read Application Data
The encrypted communication between a user and a
trusted host may be subject to a sniffing attack.
Potential Mitigations
Phase: Architecture and Design
Use a language or a library that provides a cryptography framework at a higher level of
abstraction.
Phase: Implementation
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Phase: Implementation
Applications should set up an SSL_CTX completely, before creating SSL objects from it.
CWE Version 4.14
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk