729
The following OpenSSL code ensures that there is a certificate before continuing execution.
Example Language: C (Bad)
if (cert = SSL_get_peer_certificate(ssl)) {
// got a certificate, do secret things
Because this code does not use SSL_get_verify_results() to check the certificate, it could accept
certificates that have been revoked (X509_V_ERR_CERT_REVOKED). The product could be
communicating with a malicious host.
Observed Examples
Reference Description
CVE-2011-2014 LDAP-over-SSL implementation does not check Certificate Revocation List
(CRL), allowing spoofing using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2011-2014
CVE-2011-0199 Operating system does not check Certificate Revocation List (CRL) in some
cases, allowing spoofing using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2011-0199
CVE-2010-5185 Antivirus product does not check whether certificates from signed executables
have been revoked.
https://www.cve.org/CVERecord?id=CVE-2010-5185
CVE-2009-3046 Web browser does not check if any intermediate certificates are revoked.
https://www.cve.org/CVERecord?id=CVE-2009-3046
CVE-2009-0161 chain: Ruby module for OCSP misinterprets a response, preventing detection
of a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2009-0161
CVE-2011-2701 chain: incorrect parsing of replies from OCSP responders allows bypass using
a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2011-2701
CVE-2011-0935 Router can permanently cache certain public keys, which would allow bypass if
the certificate is later revoked.
https://www.cve.org/CVERecord?id=CVE-2011-0935
CVE-2009-1358 chain: OS package manager does not properly check the return value, allowing
bypass using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2009-1358
CVE-2009-0642 chain: language interpreter does not properly check the return value from an
OSCP function, allowing bypass using a revoked certificate.
https://www.cve.org/CVERecord?id=CVE-2009-0642
CVE-2008-4679 chain: web service component does not call the expected method, which
prevents a check for revoked certificates.
https://www.cve.org/CVERecord?id=CVE-2008-4679
CVE-2006-4410 Certificate revocation list not searched for certain certificates.
https://www.cve.org/CVERecord?id=CVE-2006-4410
CVE-2006-4409 Product cannot access certificate revocation list when an HTTP proxy is being
used.
https://www.cve.org/CVERecord?id=CVE-2006-4409
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 884 CWE Cross-section 884 2567
MemberOf 948 SFP Secondary Cluster: Digital Certificate 888 2395
CWE Version 4.14
CWE-300: Channel Accessible by Non-Endpoint
CWE-300: Channel Accessible by Non-Endpoint