CWE-299 证书撤销验证不恰当 类漏洞列表 16

CWE-299 证书撤销验证不恰当 类弱点 16 条 CVE 漏洞汇总，含 AI 中文分析。

常见影响 (3)

Access Control Gain Privileges or Assume Identity

Trust may be assigned to an entity who is not who it claims to be.

Integrity, Other Other

Data from an untrusted (and possibly malicious) source may be integrated.

Confidentiality Read Application Data

Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.

缓解措施 (2)

Architecture and Design Ensure that certificates are checked for revoked status.

Implementation If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.

代码示例 (1)

The following OpenSSL code ensures that there is a certificate before continuing execution.

if (cert = SSL_get_peer_certificate(ssl)) { // got a certificate, do secret things

Bad · C