CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

MITRE CWE weakness

Description

The product modifies the SSL context after connection creation has begun.

If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Common consequences

• Access Control: Bypass Protection Mechanism
• Confidentiality: Read Application Data

Mitigations

Architecture and Design — Use a language or a library that provides a cryptography framework at a higher level of abstraction.

Implementation — Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.

Implementation — Applications should set up an SSL_CTX completely, before creating SSL objects from it.

References

• CWE page: https://cwe.mitre.org/data/definitions/593.html
• CWE list: https://cwe.mitre.org/data/index.html