CWE-1291: Public Key Re-Use for Signing both Debug and Production Code
Description
The same public key is used for signing both debug and production code.
- Abstraction
- BaseA weakness specific enough to point to detection and prevention methods.
- Likelihood of exploit
- Not rated by MITRE
- Status
- Draft
Common consequences
- ConfidentialityIntegrityAvailabilityAccess ControlAccountabilityAuthenticationAuthorizationNon-RepudiationOther
Read Memory; Modify Memory; Execute Unauthorized Code or Commands; Gain Privileges or Assume Identity; Varies by Context
Potential mitigations
- Implementation
Use different keys for Production and Debug.
Related weaknesses
Parent weaknesses
CAPEC attack patterns that exploit it
CWE 4.20 links no CAPEC attack pattern to this weakness.