Weakness (CWE)
CWE-299: Improper Check for Certificate Revocation
Base Draft
The product does not check or incorrectly checks the revocation status of a certificate.
How to prevent it (2 mitigations)
-
Architecture and Design
Ensure that certificates are checked for revoked status.
-
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
Source: MITRE CWE-299
1 result · Clear filters · Feed
-
Critical 9.4
Distrust compromised intermediate certificates in ssl module
Python has added a denylist for known compromised certificates to the "ssl" module to ensure user safety even without certificate revocation configured. Known compromised certificates will automatically be rejected regardless of the SSLContext policy configur…