Common Weakness Enumeration
CWE-599 Missing Validation of OpenSSL Certificate
Description
The product uses OpenSSL and trusts or uses a certificate without using the SSL_get_verify_result() function to ensure that the certificate satisfies all necessary security requirements.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-599 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-62rc-f4v9-h543 | CVE-2026-1778 | HIGH |
SageMaker Python SDK has Insecure TLS Configuration |
2026-02-03 | |
| GHSA-wf93-3ghh-h389 | CVE-2026-25060 | HIGH |
OpenList has Insecure TLS Default Configuration |
2026-02-03 | |
| GHSA-vw7g-3cc7-7rmh | CVE-2024-41265 | HIGH |
cortex establishes TLS connections with `InsecureSkipVerify` set to `true` |
2025-12-20 | |
| GHSA-8r96-8889-qg2x | CVE-2023-48052 | HIGH |
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack |
2025-02-06 | |
| GHSA-r6qh-j42j-pw64 | CVE-2024-40464 | HIGH |
Beego privilege escalation vulnerability |
2024-08-06 |