CWE-593 — Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
MITRE CWE weakness
| Kind | Weakness |
| Abstraction | Variant |
| Status | Draft |
| Likelihood of exploit | — |
Description
The product modifies the SSL context after connection creation has begun.
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
Common consequences
- Access Control: Bypass Protection Mechanism
- Confidentiality: Read Application Data
Mitigations
Architecture and Design — Use a language or a library that provides a cryptography framework at a higher level of abstraction.
Implementation — Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Implementation — Applications should set up an SSL_CTX completely, before creating SSL objects from it.
References
- CWE page: https://cwe.mitre.org/data/definitions/593.html
- CWE list: https://cwe.mitre.org/data/index.html