Skip to content
OpenAdvisories

Weakness (CWE)

CWE-324: Use of a Key Past its Expiration Date

Base Draft

The product uses a cryptographic key past its expiration date.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.

  2. Implementation

    Replace keys within a period of time proportional to their strength.

Source: MITRE CWE-324

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-36031

    keys: Fix overwrite of key expiration on instantiation

    In the Linux kernel, the following vulnerability has been resolved: keys: Fix overwrite of key expiration on instantiation The expiry time of a key is unconditionally overwritten during instantiation, defaulting to turn it permanent. This causes a problem for…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.0
    CVE-2022-35401 EPSS 21%

    An authentication bypass vulnerability exists in the get_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386_496…

    ASUS RT-AX82U
  • Critical 9.8
    CVE-2019-10643

    Contao Does Not Expire Tokens Correctly

    Contao 4.7 allows Use of a Key Past its Expiration Date.

    contao/core-bundle contao/contao Packagist