The product modifies the SSL context after connection creation has begun.
If the program modifies the SSL_CTX object after creating SSL objects from it, there is the possibility that older SSL objects created from the original context could all be affected by that change.

Resultant

Implementation
REALIZATION: This weakness is caused during implementation of an architectural security tactic.

Access Control
Bypass Protection Mechanism
No authentication takes place in this process, bypassing an assumed protection of encryption.

Confidentiality
Read Application Data
The encrypted communication between a user and a trusted host may be subject to a sniffing attack.

Architecture and Design
Use a language or a library that provides a cryptography framework at a higher level of abstraction.

Implementation
Most SSL_CTX functions have SSL counterparts that act on SSL-type objects.

Implementation
Applications should set up an SSL_CTX completely, before creating SSL objects from it.

The following example demonstrates the weakness.

#define CERT "secret.pem"#define CERT2 "secret2.pem"
int main(){
SSL_CTX *ctx;SSL *ssl;init_OpenSSL();seed_prng();
ctx = SSL_CTX_new(SSLv23_method());
if (SSL_CTX_use_certificate_chain_file(ctx, CERT) != 1)int_error("Error loading certificate from file");

if (SSL_CTX_use_PrivateKey_file(ctx, CERT, SSL_FILETYPE_PEM) != 1)int_error("Error loading private key from file");

if (!(ssl = SSL_new(ctx)))int_error("Error creating an SSL context");

if ( SSL_CTX_set_default_passwd_cb(ctx, "new default password" != 1))int_error("Doing something which is dangerous to do anyways");

if (!(ssl2 = SSL_new(ctx)))int_error("Error creating an SSL context");

}

Allowed
This CWE entry is at the Variant level of abstraction, which is a preferred level of abstraction for mapping to the root causes of vulnerabilities.
Carefully read both the name and description to ensure that this mapping is an appropriate fit. Do not try to 'force' a mapping to a lower-level Base/Variant simply to comply with this preferred level of abstraction.

CWE Community
2006-12-15
Draft 5
2006-12-15
Submitted by members of the CWE community to extend early CWE versions

Eric Dalci
Cigital
2008-07-01
updated Time_of_Introduction

CWE Content Team
MITRE
2008-09-08
updated Common_Consequences, Relationships, Other_Notes

CWE Content Team
MITRE
2009-07-27
updated Description, Other_Notes, Potential_Mitigations

CWE Content Team
MITRE
2011-06-01
updated Common_Consequences

CWE Content Team
MITRE
2011-06-27
updated Common_Consequences

CWE Content Team
MITRE
2012-05-11
updated Relationships

CWE Content Team
MITRE
2014-07-30
updated Relationships

CWE Content Team
MITRE
2017-05-03
updated Potential_Mitigations, Relationships

CWE Content Team
MITRE
2017-11-08
updated Demonstrative_Examples, Modes_of_Introduction, Relationships

CWE Content Team
MITRE
2020-02-24
updated Common_Consequences, Relationships

CWE Content Team
MITRE
2022-10-13
updated Relationships

CWE Content Team
MITRE
2023-01-31
updated Description

CWE Content Team
MITRE
2023-04-27
updated Relationships, Time_of_Introduction

CWE Content Team
MITRE
2023-06-29
updated Mapping_Notes

CWE Content Team
MITRE
2025-12-11
4.19
2025-12-11
updated Applicable_Platforms, Weakness_Ordinalities