CWE-593β€”Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

PUBLISHEDweakness record
released 2006-12-15 Β· last modified 2025-12-11

Metadata

CWE ID:
CWE-593
Abstraction:
Variant
Structure:
Simple
Status:
Draft
Release Date:
2006-12-15
Latest Modification Date:
2025-12-11

Weakness Name

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

Description

The product modifies the SSL context after connection creation has begun.

If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Common Consequences

Scope:
Access Control
Impact:
Bypass Protection Mechanism
Notes:
No authentication takes place in this process, bypassing an assumed protection of encryption.
Scope:
Confidentiality
Impact:
Read Application Data
Notes:
The encrypted communication between a user and a trusted host may be subject to a sniffing attack.

Related Weaknesses

browse all CWEs