CVE-2026-9058
0.04%V4
2026-05-25
14h16 +00:00
14h16 +00:00
指定 CVE 通知
随时了解指定 CVE 的变更。
CVE 描述
For untrusted certificates that contain the "Authority Information Access - caIssuers URI" extension, Szafir SDK will automatically download the parent CA certificate from the specified URL and will import it to its trust store as a "nonqualified" certificate. In such a case, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nonqualified".
For other types of untrusted certificates, Szafir SDK returns a success status code of 0 ("Positively verified") upon successful cryptographic verification and a certificate status of "nondetermined".
This may lead integrating applications to incorrectly treat the digital signature as valid despite an untrusted certificate chain. This flaw enables authentication bypass and user impersonation:
(1) in use-cases other than qualified certificate authentication, or
(2) if the qualified certificate authentication use-case is not correctly implemented by the integrating application.
This issue was fixed in version 1.8.463.2.
CVE 信息
相关弱点
| 弱点名称 | 来源 | |
|---|---|---|
| Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate. |
||
| Return of Wrong Status Code A function or operation returns an incorrect return value or status code that does not indicate the true result of execution, causing the product to modify its behavior based on the incorrect result. |
||
| Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used. |
EPSS
EPSS 是一种预测漏洞被利用可能性的评分模型。
EPSS 评分
EPSS 模型生成一个介于 0 到 1（即 0% 到 100%）之间的概率评分。评分越高，漏洞被利用的可能性越大。
EPSS 百分位
百分位用于根据 EPSS 评分对 CVE 进行排名。例如，EPSS 百分位为第 95 的 CVE，其被利用的可能性高于 95% 的其他 CVE。因此，百分位可用于比较不同 CVE 的 EPSS 评分。
