CWE-757Selection of Less-Secure Algorithm During Negotiation

Description

A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used in a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties.

Common consequences

• Access Control→Bypass Protection Mechanism
  When a security mechanism can be forced to downgrade to use a less secure algorithm, this can make it easier for attackers to compromise the product by exploiting the weaker algorithm. The victim might not be aware that the less secure algo

Related CWEs

Recent CVEs classified under this CWE