CWE-599: Missing Validation of OpenSSL Certificate

Variant

The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.

Consequences

Confidentiality: Read Application Data
Access Control: Bypass Protection Mechanism, Gain Privileges or Assume Identity
Access Control: Gain Privileges or Assume Identity

How to prevent it

Architecture and Design: Ensure that proper authentication is included in the system design.
Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.

Recent advisories

GO-2022-0518 — Argo CD certificate verification is skipped for connections to OIDC providers

All advisories for CWE-599

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor