CWE•Variant•Draft•1 recent CVE
CWE-370Missing Check for Certificate Revocation after Initial Check
Description
The product does not check the revocation status of a certificate after its initial revocation check, which can cause the product to perform privileged actions even after the certificate is revoked at a later time.
Common consequences
- Access Control→Gain Privileges or Assume IdentityIf the revocation status of a certificate is not checked before each action that requires privileges, the system may be subject to a race condition. Trust may be assigned to an entity who is not who it claims to be. If a certificate is revo
- Integrity→Modify Application DataData from an untrusted (and possibly malicious) source may be integrated.
- Confidentiality→Read Application DataData may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.
Potential mitigations
- Architecture and DesignEnsure that certificates are checked for revoked status before each use of a protected resource. If the certificate is checked before each access of a protected resource, the delay subject to a possible race condition becomes almost negligible and significantly reduces the risk associated with this issue.