Description

The software modifies the SSL context after connection creation has begun.

If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Modes of Introduction:

– Architecture and Design

Related Weaknesses

CWE-666
CWE-287

Consequences

Access Control: Bypass Protection Mechanism

No authentication takes place in this process, bypassing an assumed protection of encryption.

Confidentiality: Read Application Data

The encrypted communication between a user and a trusted host may be subject to a sniffing attack.

Potential Mitigations

Phase: Architecture and Design

Description: 

Use a language or a library that provides a cryptography framework at a higher level of abstraction.

Phase: Implementation

Description: 

Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.

Phase: Implementation

Description: 

Applications should set up an SSL_CTX completely, before creating SSL objects from it.

CVE References