Improper Validation of Certificate Expiration

Opis

A certificate expiration is not validated or is incorrectly validated.

Skutki

• Integrity, Other

  Other

  The data read from the system vouched for by the expired certificate may be flawed due to malicious spoofing.

• Authentication, Other

  Other

  Trust may be assigned to certificates that have been abandoned due to age.

Zapobieganie

• Architecture and Design

  Check for expired certificates and provide the user with adequate information about the nature of the problem and how to proceed.

• Implementation

  If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the expiration.

Przykłady podatności

• CVE-2025-4384 product does not verify that a certificate has expired
• CVE-2007-3564 web library product does not verify that a certificate has expired
• CVE-2007-6746 IRC product does not check the expiration date of the X.509 certificate
• CVE-2007-6746 library for SSL and TLS does not check the activation or expiration dates of CA certificates

Słabość nadrzędna

• CWE-295 Improper Certificate Validation
• CWE-672 Operation on a Resource after Expiration or Release

Kiedy powstaje

• Implementation — When the software uses certificate pinning, the developer might not properly validate all relevant components of the certificate before pinning the certificate. This can make it difficult or expensive to test after the pinning is complete.
• Implementation — REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Dotyczy

Not Language-Specific

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005
2. 24 Deadly Sins of Software Security — Michael Howard, David LeBlanc, John Viega, "Sin 23: Improper Use of PKI, Especially SSL." Page 347, McGraw-Hill, 2010