名稱: Use of a Key Past its Expiration Date

The product uses a cryptographic key past its expiration date.

一般資訊

引入方式

Architecture and Design : REALIZATION: This weakness is caused during implementation of an architectural security tactic.

適用平台

程式語言

類別： Not Language-Specific (Undetermined)

常見後果

範圍	影響	可能性
Access Control	Bypass Protection Mechanism, Gain Privileges or Assume Identity 注意：Using a key past its expiration data increases the timing window for cracking attacks against that key. Or, the key in question may be compromised, providing a malicious user with a method for authenticating as the victim.

觀察到的案例

參考資料	描述
CVE-2021-33020	Picture Archiving and Communication System (PACS) system for hospitals uses a cryptographic key or password past its expiration date

潛在緩解措施

Phases : Architecture and Design
Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
Phases : Implementation
Replace keys within a period of time proportional to their strength.

漏洞對應備注

理由說明 : This CWE entry is at the Base level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
備註 : Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

參考資料

REF-44

24 Deadly Sins of Software Security
Michael Howard, David LeBlanc, John Viega.

REF-18

The CLASP Application Security Process
Secure Software, Inc..
https://cwe.mitre.org/documents/sources/TheCLASPApplicationSecurityProcess.pdf

提交

名稱	機構	日期	發布日期	Version
CLASP		2006-07-19 +00:00	2006-07-19 +00:00	Draft 3

修改記錄

名稱	機構	日期	備註
Eric Dalci	Cigital	2008-07-01 +00:00	updated Time_of_Introduction
CWE Content Team	MITRE	2008-09-08 +00:00	updated Common_Consequences, Relationships, Other_Notes, Taxonomy_Mappings
CWE Content Team	MITRE	2009-05-27 +00:00	updated Demonstrative_Examples
CWE Content Team	MITRE	2011-06-01 +00:00	updated Common_Consequences
CWE Content Team	MITRE	2012-05-11 +00:00	updated References, Relationships
CWE Content Team	MITRE	2012-10-30 +00:00	updated Potential_Mitigations
CWE Content Team	MITRE	2013-02-21 +00:00	updated Applicable_Platforms, Demonstrative_Examples, Description, Other_Notes
CWE Content Team	MITRE	2014-07-30 +00:00	updated Demonstrative_Examples, Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Demonstrative_Examples, Modes_of_Introduction, Relationships
CWE Content Team	MITRE	2020-02-24 +00:00	updated Relationships
CWE Content Team	MITRE	2021-03-15 +00:00	updated References
CWE Content Team	MITRE	2021-10-28 +00:00	updated Relationships
CWE Content Team	MITRE	2023-04-27 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2023-10-26 +00:00	updated Observed_Examples
CWE Content Team	MITRE	2025-12-11 +00:00	updated Relationships, Weakness_Ordinalities
CWE Content Team	MITRE	2026-10-28 +00:00	updated Common_Consequences, Description, Potential_Mitigations

CWE-324 詳細資料

CWE-324