CWE-1291: Public Key Re-Use for Signing both Debug and Production Code
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The same public key is used for signing both debug and production code.
常见后果
影响范围: Confidentiality Integrity Availability Access Control Accountability Authentication Authorization Non-Repudiation Other
技术影响: Read Memory Modify Memory Execute Unauthorized Code or Commands Gain Privileges or Assume Identity Varies by Context
潜在缓解措施
阶段: Implementation
描述: Use different keys for Production and Debug
检测方法
方法: Architecture or Design Review
有效性: High
方法: Dynamic Analysis with Manual Results Interpretation
有效性: High
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | - |