logo

CWE-593 - Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

CWE-593

  • Abstraction:
  • Variant
  • Structure:
  • Simple
  • Status:
  • Draft
Weakness Name

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

Description

The product modifies the SSL context after connection creation has begun.

If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Common Consequences

Scope: Access Control

Impact: Bypass Protection Mechanism

Notes: No authentication takes place in this process, bypassing an assumed protection of encryption.

Scope: Confidentiality

Impact: Read Application Data

Notes: The encrypted communication between a user and a trusted host may be subject to a sniffing attack.

Related Weaknesses
  • Release Date:
  • 2006-12-15
  • Latest Modification Date:
  • 2023-06-29

Free security scan for your website