CWE-593 - Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
- Abstraction:Variant
- Structure:Simple
- Status:Draft
- Release Date:2006-12-15
- Latest Modification Date:2023-06-29
Weakness Name
Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
Description
The product modifies the SSL context after connection creation has begun.
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
Common Consequences
Scope: Access Control
Impact: Bypass Protection Mechanism
Notes: No authentication takes place in this process, bypassing an assumed protection of encryption.
Scope: Confidentiality
Impact: Read Application Data
Notes: The encrypted communication between a user and a trusted host may be subject to a sniffing attack.