Name: Missing Validation of OpenSSL Certificate

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

General Informations

Modes Of Introduction

Implementation

Applicable Platforms

Language

Class: Not Language-Specific (Undetermined)

Common Consequences

Scope	Impact	Likelihood
Confidentiality	Read Application Data Note: The data read may not be properly secured - it might be viewed by an attacker.
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity Note: Trust afforded to the system in question may allow for spoofing or redirection attacks.
Access Control	Gain Privileges or Assume Identity Note: If the certificate is not checked, it may be possible for a redirection or spoofing attack to allow a malicious host with a valid certificate to provide data under the guise of a trusted host. While the attacker in question may have a valid certificate, it may simply be a valid certificate for a different site. This could allow an attacker to use an invalid certificate to claim to be a trusted host, use expired certificates, or conduct other attacks that could be detected if the certificate is properly validated. In order to ensure data integrity, we must check that the certificate is valid, and that it pertains to the site we wish to access.

Potential Mitigations

Phases : Architecture and Design
Ensure that proper authentication is included in the system design.
Phases : Implementation
Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Vulnerability Mapping Notes

Justification : This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Comment : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

Notes

CWE-295 and CWE-599 are very similar, although CWE-599 has a more narrow scope that is only applied to OpenSSL certificates. As a result, other children of CWE-295 can be regarded as children of CWE-599 as well. CWE's use of one-dimensional hierarchical relationships is not well-suited to handle different kinds of abstraction relationships based on concepts like types of resources ("OpenSSL certificate" as a child of "any certificate") and types of behaviors ("not validating expiration" as a child of "improper validation").

Submission

Name	Organization	Date	Date release	Version
CWE Community		2006-12-15 +00:00	2006-12-15 +00:00	Draft 5

Modifications

Name	Organization	Date	Comment
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Other_Notes
CWE Content Team	MITRE	2009-03-10 +00:00	updated Relationships
CWE Content Team	MITRE	2009-07-27 +00:00	updated Relationships
CWE Content Team	MITRE	2010-12-13 +00:00	updated Description
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences, Other_Notes
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2013-02-21 +00:00	updated Demonstrative_Examples, Description, Name, Relationship_Notes, Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2019-09-19 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description
CWE Content Team	MITRE	2023-04-27 +00:00	updated Modes_of_Introduction, Relationships, Time_of_Introduction
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2025-12-11 +00:00	updated Applicable_Platforms, Weakness_Ordinalities
CWE Content Team	MITRE	2026-04-30 +00:00	updated Common_Consequences, Description, Diagram

CWE-599 Detail

CWE-599