VariantDraftCWE-298

CWE-298: Improper Validation of Certificate Expiration

Description

A certificate expiration is not validated or is incorrectly validated.

Abstraction: VariantA weakness tied to a specific language, technology or resource.
Likelihood of exploit: Low
Status: Draft

Common consequences

IntegrityOther
Other
The data read from the system vouched for by the expired certificate may be flawed due to malicious spoofing.
AuthenticationOther
Other
Trust may be assigned to certificates that have been abandoned due to age.

Potential mitigations

Architecture and Design
Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.

Related weaknesses

Parent weaknesses

CAPEC attack patterns that exploit it

CWE 4.20 links no CAPEC attack pattern to this weakness.

Potential mitigations

Architecture and Design

Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

Implementation

If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.