Missing Validation of OpenSSL Certificate
CWE-599
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
We track 6 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.1.
How this weakness is prevented
- Architecture and Design: Ensure that proper authentication is included in the system design.
- Implementation: Understand and properly implement all checks necessary to ensure the identity of entities involved in encrypted communications.
Latest Missing Validation of OpenSSL Certificate vulnerabilities
- 8.1 High severity
OpenList: Missing Validation of OpenSSL Certificate
OpenList Frontend is a UI component for OpenList. Prior to 4.1.10, certificate verification is disabled by default for all storage driver communications. The TlsInsecureSkipVerify setting is default to true in the DefaultConfig() function in internal/conf/conf
- 7.5 High severity
cortex: Missing Validation of OpenSSL Certificate
A TLS certificate verification issue discovered in cortex v0.42.1 allows attackers to obtain sensitive information via the makeOperatorRequest function.
- 7.1 High severity
goframe: Missing Validation of OpenSSL Certificate
goframe v2.7.2 is configured to skip TLS certificate verification, possibly allowing attackers to execute a man-in-the-middle attack via the gclient component.
- 8.8 High severity
beego: Improper Certificate Validation
An issue in beego v.2.2.0 and before allows a remote attacker to escalate privileges via the sendMail function located in beego/core/logs/smtp.go file
- 7.4 High severity
httpie: Improper Certificate Validation
Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
- 9.6 Critical severity
argo-cd: Improper Certificate Validation
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Argo CD starting with version 0.4.0 and prior to 2.2.11, 2.3.6, and 2.4.5 is vulnerable to an improper certificate validation bug which could cause Argo CD to trust a malicious (or other