CWE-299: Improper Check for Certificate Revocation
CWE版本: 4.18
更新日期: 2025-09-09
弱点描述
The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
扩展描述
An improper check for certificate revocation is a far more serious flaw than related certificate failures. This is because the use of any revoked certificate is almost certainly malicious. The most common reason for certificate revocation is compromise of the system in question, with the result that no legitimate servers will be using a revoked certificate, unless they are sorely out of sync.
常见后果
影响范围: Access Control
技术影响: Gain Privileges or Assume Identity
说明: Trust may be assigned to an entity who is not who it claims to be.
影响范围: Integrity Other
技术影响: Other
说明: Data from an untrusted (and possibly malicious) source may be integrated.
影响范围: Confidentiality
技术影响: Read Application Data
说明: Data may be disclosed to an entity impersonating a trusted entity, resulting in information disclosure.
潜在缓解措施
阶段: Architecture and Design
描述: Ensure that certificates are checked for revoked status.
阶段: Implementation
描述: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
检测方法
方法: Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
有效性: High
观察示例
参考: CVE-2011-2014
LDAP-over-SSL implementation does not check Certificate Revocation List (CRL), allowing spoofing using a revoked certificate.
参考: CVE-2011-0199
Operating system does not check Certificate Revocation List (CRL) in some cases, allowing spoofing using a revoked certificate.
参考: CVE-2010-5185
Antivirus product does not check whether certificates from signed executables have been revoked.
参考: CVE-2009-3046
Web browser does not check if any intermediate certificates are revoked.
参考: CVE-2009-0161
chain: Ruby module for OCSP misinterprets a response, preventing detection of a revoked certificate.
参考: CVE-2011-2701
chain: incorrect parsing of replies from OCSP responders allows bypass using a revoked certificate.
参考: CVE-2011-0935
Router can permanently cache certain public keys, which would allow bypass if the certificate is later revoked.
参考: CVE-2009-1358
chain: OS package manager does not properly check the return value, allowing bypass using a revoked certificate.
参考: CVE-2009-0642
chain: language interpreter does not properly check the return value from an OSCP function, allowing bypass using a revoked certificate.
参考: CVE-2008-4679
chain: web service component does not call the expected method, which prevents a check for revoked certificates.
参考: CVE-2006-4410
Certificate revocation list not searched for certain certificates.
参考: CVE-2006-4409
Product cannot access certificate revocation list when an HTTP proxy is being used.
引入模式
| 阶段 | 说明 |
|---|---|
| Implementation | When the product uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete. |
| Implementation | REALIZATION: This weakness is caused during implementation of an architectural security tactic. |
适用平台
编程语言
分类映射
| 分类名称 | 条目ID | 条目名称 | 映射适配度 |
|---|---|---|---|
| CLASP | - | Failure to check for certificate revocation | - |