CWE-324 使用已过期的密钥 类漏洞列表 19

CWE-324 使用已过期的密钥 类弱点 19 条 CVE 漏洞汇总，含 AI 中文分析。

常见影响 (1)

Access Control Bypass Protection Mechanism, Gain Privileges or Assume Identity

The cryptographic key in question may be compromised, providing a malicious user with a method for authenticating as the victim.

缓解措施 (1)

Architecture and Design Adequate consideration should be put in to the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.

代码示例 (1)

The following code attempts to verify that a certificate is valid.

if (cert = SSL_get_peer_certificate(ssl)) { foo=SSL_get_verify_result(ssl); if ((X509_V_OK==foo) || (X509_V_ERRCERT_NOT_YET_VALID==foo)) //do stuff }

Bad · C