日本語

CWE-324 詳細

CWE-324

Use of a Key Past its Expiration Date
2006-07-19
00h00 +00:00
低
Draft
2026-10-28
00h00 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Use of a Key Past its Expiration Date

The product uses a cryptographic key past its expiration date.

一般情報

導入モード

Architecture and Design : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

適用可能なプラットフォーム

言語

クラス： Not Language-Specific (Undetermined)

一般的な結果

スコープ 影響 可能性
Access ControlBypass Protection Mechanism, Gain Privileges or Assume Identity

注記：Using a key past its expiration data increases the timing window for cracking attacks against that key. Or, the key in question may be compromised, providing a malicious user with a method for authenticating as the victim.

観察された例

参考文献 説明

CVE-2021-33020

Picture Archiving and Communication System (PACS) system for hospitals uses a cryptographic key or password past its expiration date

潜在的な緩和策

Phases : Architecture and Design
Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
Phases : Implementation
Replace keys within a period of time proportional to their strength.

脆弱性マッピングノート

理由 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
コメント : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

参考文献

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

登録情報

名前 組織 日付 リリース日 Version
CLASP 2006-07-19 +00:00 2006-07-19 +00:00 Draft 3

変更履歴

名前 組織 日付 コメント
Eric Dalci Cigital 2008-07-01 +00:00 updated Time_of_Introduction
CWE Content Team MITRE 2008-09-08 +00:00 updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team MITRE 2009-05-27 +00:00 updated Demonstrative_Examples
CWE Content Team MITRE 2011-06-01 +00:00 updated Common_Consequences
CWE Content Team MITRE 2012-05-11 +00:00 updated References, Relationships
CWE Content Team MITRE 2012-10-30 +00:00 updated Potential_Mitigations
CWE Content Team MITRE 2013-02-21 +00:00 updated Applicable_Platforms, Demonstrative_Examples, Description, Other_Notes
CWE Content Team MITRE 2014-07-30 +00:00 updated Demonstrative_Examples, Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Demonstrative_Examples, Modes_of_Introduction, Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2021-03-15 +00:00 updated References
CWE Content Team MITRE 2021-10-28 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2023-10-26 +00:00 updated Observed_Examples
CWE Content Team MITRE 2025-12-11 +00:00 updated Relationships, Weakness_Ordinalities
CWE Content Team MITRE 2026-10-28 +00:00 updated Common_Consequences, Description, Potential_Mitigations
CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。