The product modifies the SSL context after connection creation has begun.
View on MITREIf the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
No authentication takes place in this process, bypassing an assumed protection of encryption.
The encrypted communication between a user and a trusted host may be subject to a sniffing attack.
Use a language or a library that provides a cryptography framework at a higher level of abstraction.
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.
Applications should set up an SSL_CTX completely, before creating SSL objects from it.
No detection method information available for this CWE.
The following example demonstrates the weakness.
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created is a Common Weakness Enumeration (CWE) entry maintained by MITRE. The product modifies the SSL context after connection creation has begun. If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.
If exploited, CWE-593 (Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created) it can compromise Access Control and Confidentiality, leading to outcomes such as Bypass Protection Mechanism and Read Application Data.
Recommended mitigations for CWE-593 include: Use a language or a library that provides a cryptography framework at a higher level of abstraction. Most SSL_CTX functions have SSL counterparts that act on SSL-type objects. Applications should set up an SSL_CTX completely, before creating SSL objects from it.
A CWE (Common Weakness Enumeration) like CWE-593 describes a category of software weakness — the underlying flaw type. A CVE (Common Vulnerabilities and Exposures) identifies a specific, real-world vulnerability in a particular product. In short, a CWE is the kind of mistake, and a CVE is an instance of that mistake being found in software.