名称: Improper Handling of Exceptional Conditions

The product does not handle or incorrectly handles an exceptional condition.

基本信息

引入方式

Implementation : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

适用平台

编程语言

类： Not Language-Specific (Undetermined)
名称： Python (Undetermined)

常见后果

影响范围	影响	可能性
Other	Other

观察示例

参考资料	描述
CVE-2023-41151	SDK for OPC Unified Architecture (OPC UA) server has uncaught exception when a socket is blocked for writing but the server tries to send an error
[REF-1374]	Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391)
CVE-2021-3011	virtual interrupt controller in a virtualization product allows crash of host by writing a certain invalid value to a register, which triggers a fatal error instead of returning an error code
CVE-2008-4302	Chain: OS kernel does not properly handle a failure of a function call (CWE-755), leading to an unlock of a resource that was not locked (CWE-832), with resultant crash.

检测方法

Automated Static Analysis

Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

漏洞映射说明

依据 : This CWE entry is a level-1 Class (i.e., a child of a Pillar). It might have lower-level children that would be more appropriate
备注 : Examine children of this entry to see if there is a better fit

参考资料

REF-1374

Randstorm: You Can't Patch a House of Cards
Unciphered.
https://www.unciphered.com/disclosure-of-vulnerable-bitcoin-wallet-library-2/

REF-1541

Secure Coding Guide for Python
OpenSSF.
https://best.openssf.org/Secure-Coding-Guide-for-Python/

提交记录

名称	组织	日期	发布日期	Version
CWE Content Team	MITRE	2009-03-03 +00:00	2009-03-10 +00:00	1.3

修改记录

名称	组织	日期	备注
CWE Content Team	MITRE	2009-12-28 +00:00	updated Applicable_Platforms, Likelihood_of_Exploit, Time_of_Introduction
CWE Content Team	MITRE	2010-12-13 +00:00	updated Description, Observed_Examples
CWE Content Team	MITRE	2011-03-29 +00:00	updated Relationships
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2011-09-13 +00:00	updated Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2012-05-11 +00:00	updated Relationships
CWE Content Team	MITRE	2014-07-30 +00:00	updated Relationships
CWE Content Team	MITRE	2017-01-19 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Likelihood_of_Exploit, Modes_of_Introduction, Relationships, Taxonomy_Mappings
CWE Content Team	MITRE	2019-06-20 +00:00	updated Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2020-06-25 +00:00	updated Relationships
CWE Content Team	MITRE	2021-10-28 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2022-04-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-01-31 +00:00	updated Description, Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes, Relationships
CWE Content Team	MITRE	2024-02-29 +00:00	updated Demonstrative_Examples, Mapping_Notes, Observed_Examples, References, Relationships
CWE Content Team	MITRE	2025-09-09 +00:00	updated References
CWE Content Team	MITRE	2025-12-11 +00:00	updated Detection_Factors, Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Applicable_Platforms, References, Relationships, Taxonomy_Mappings

CWE-755 详情

CWE-755