Weakness (CWE)
CWE-299: Improper Check for Certificate Revocation
The product does not check or incorrectly checks the revocation status of a certificate.
How to prevent it (2 mitigations)
-
Architecture and Design
Ensure that certificates are checked for revoked status.
-
Implementation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the revoked status.
Source: MITRE CWE-299
3 results · Clear filters · Feed
-
Low 2.3
CRL check skipped when OCSP enabled and certificate has no OCSP URL
When an application enables both OCSP and CRL revocation checking on one WOLFSSL_CTX or certificate manager, wolfSSL skips the CRL check for any peer certificate that carries no Authority Information Access OCSP URL, and accepts a certificate the loaded CRL l…
-
Low 3.7
mwiede jsch KnownHosts.java getRevokedKeys improper check for certificate revocation
A security flaw has been discovered in mwiede jsch up to 2.28.5. Affected is the function getRevokedKeys of the file src/main/java/com/jcraft/jsch/KnownHosts.java. Performing a manipulation of the argument known_hosts results in improper check for certificate…
-
Low —
sequoia-git has broken hard revocation handling
Before `sq-git` checks if a commit can be authenticated, it first looks for hard revocations. Because parsing a policy is expensive and a project's policy rarely changes, `sq-git` has an optimization to only check a policy if it hasn't checked it before. It d…