CWE-593
Weakness AllowedAuthentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Abstraction: Variant · Status: Draft
The product modifies the SSL context after connection creation has begun.
Mapping guidance
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.
Modes of introduction
REALIZATION: This weakness is caused during implementation of an architectural security tactic.
Content history
Submitted by members of the CWE community to extend early CWE versions
updated Time_of_Introduction
updated Common_Consequences, Relationships, Other_Notes
updated Description, Other_Notes, Potential_Mitigations
updated Common_Consequences
updated Common_Consequences
updated Relationships
updated Relationships
updated Potential_Mitigations, Relationships
updated Demonstrative_Examples, Modes_of_Introduction, Relationships
updated Common_Consequences, Relationships
updated Relationships
updated Description
updated Relationships, Time_of_Introduction
updated Mapping_Notes
updated Applicable_Platforms, Weakness_Ordinalities
updated Common_Consequences, Description
0 vulnerabilities reference this CWE, most recent first.
No vulnerabilities reference this CWE.
Mitigation
Use a language or a library that provides a cryptography framework at a higher level of abstraction.
Mitigation
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Mitigation
Applications should set up an SSL_CTX completely, before creating SSL objects from it.
CAPEC-94: Adversary in the Middle (AiTM)
An adversary targets the communication between two components (typically client and server), in order to alter or obtain data from transactions. A general approach entails the adversary placing themself within the communication channel between the two components.