CWE-347 密码学签名的验证不恰当

Improper Verification of Cryptographic Signature

结构: Simple

Abstraction: Base

状态: Draft

被利用可能性: unkown


The software does not verify, or incorrectly verifies, the cryptographic signature for data.


  • cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 1000 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 1003 cwe_Ordinal: Primary

  • cwe_Nature: ChildOf cwe_CWE_ID: 345 cwe_View_ID: 699


Language: {'cwe_Class': 'Language-Independent', 'cwe_Prevalence': 'Undetermined'}


范围 影响 注释
['Access Control', 'Integrity', 'Confidentiality'] ['Gain Privileges or Assume Identity', 'Modify Application Data', 'Execute Unauthorized Code or Commands'] An attacker could gain access to sensitive data and possibly execute unauthorized code.


In the following code, a JarFile object is created from a downloaded file.

bad Java

File f = new File(downloadedFilePath);
JarFile jf = new JarFile(f);

The JAR file that was potentially downloaded from an untrusted source is created without verifying the signature (if present). An alternate constructor that accepts a boolean verify parameter should be used instead.


标识 说明 链接
CVE-2002-1796 Does not properly verify signatures for "trusted" entities.
CVE-2005-2181 Insufficient verification allows spoofing.
CVE-2005-2182 Insufficient verification allows spoofing.
CVE-2002-1706 Accepts a configuration file without a Message Integrity Check (MIC) signature.


映射的分类名 ImNode ID Fit Mapped Node Name
PLOVER Improperly Verified Signature
The CERT Oracle Secure Coding Standard for Java (2011) SEC06-J Do not rely on the default automatic signature verification provided by URLClassLoader and java.util.jar


  • CAPEC-463