Weakness (CWE)
CWE-324: Use of a Key Past its Expiration Date
Base Draft
The product uses a cryptographic key past its expiration date.
How to prevent it (2 mitigations)
-
Architecture and Design
Adequate consideration should be put into the user interface in order to notify users previous to the key's expiration, to explain the importance of new key generation and to walk users through the process as painlessly as possible.
-
Implementation
Replace keys within a period of time proportional to their strength.
Source: MITRE CWE-324
1 result · Clear filters · Feed
-
Low 3.1
sigstore-go fails to check signature timestamps against a signing key's validity period
sigstore-go is a Go library for Sigstore signing and verification. Prior to 1.2.1, sigstore-go does not check a bundle signing timestamp against the validity window of an ExpiringKey wrapping a self-managed long-lived signing key without a certificate, which …