CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
The product modifies the SSL context after connection creation has begun.
Last updated
Overview
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
Common consequences
What can happen when CWE-593 is exploited.
Bypass Protection Mechanism
Affects: Access Control
No authentication takes place in this process, bypassing an assumed protection of encryption.
Read Application Data
Affects: Confidentiality
The encrypted communication between a user and a trusted host may be subject to a sniffing attack.
How it happens
When it is introduced
Typically introduced during these phases of the software lifecycle.
How to prevent it
Practical mitigations for CWE-593, grouped by where in the lifecycle they apply.
Use a language or a library that provides a cryptography framework at a higher level of abstraction.