1456
Phase: Testing
Use Static analysis tools to check for unreleased resources.
Observed Examples
Reference Description
CVE-2018-1000613Cryptography API uses unsafe reflection when deserializing a private key
https://www.cve.org/CVERecord?id=CVE-2018-1000613
CVE-2022-21668 Chain: Python library does not limit the resources used to process images
that specify a very large number of bands (CWE-1284), leading to excessive
memory consumption (CWE-789) or an integer overflow (CWE-190).
https://www.cve.org/CVERecord?id=CVE-2022-21668
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 984 SFP Secondary Cluster: Life Cycle 888 2411
MemberOf 1163 SEI CERT C Coding Standard - Guidelines 09. Input
Output (FIO)
1154 2459
MemberOf 1370 ICS Supply Chain: Common Mode Frailties 1358 2507
MemberOf 1416 Comprehensive Categorization: Resource Lifecycle
Management
1400 2545
Notes
Maintenance
More work is needed on this entry and its children. There are perspective/layering issues;
for example, one breakdown is based on lifecycle phase (CWE-404, CWE-665), while other
children are independent of lifecycle, such as CWE-400. Others do not specify as many bases or
variants, such as CWE-704, which primarily covers numbers at this stage.
Taxonomy Mappings
Mapped Taxonomy Name Node ID Fit Mapped Node Name
CERT C Secure Coding FIO39-C CWE More
Abstract
Do not alternately input and output from
a stream without an intervening flush or
positioning call
Related Attack Patterns
CAPEC-ID Attack Pattern Name
21 Exploitation of Trusted Identifiers
60 Reusing Session IDs (aka Session Replay)
61 Session Fixation
62 Cross Site Request Forgery
196 Session Credential Falsification through Forging
CWE-665: Improper Initialization
Weakness ID : 665
Structure : Simple
Abstraction : Class
Description
CWE Version 4.14
CWE-665: Improper Initialization
CWE-665: Improper Initialization