CWE-347: Improper Verification of Cryptographic Signature
Improper Verification of Cryptographic Signature
Weakness ID: 347 (Weakness Base)
Status: Draft
Description
Description Summary
The software does not verify, or incorrectly verifies, the
cryptographic signature for data.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
All
Demonstrative Examples
Example 1
In the following Java snippet, a JarFile object (representing a JAR
file that was potentially downloaded from an untrusted source) is created
without verifying the signature (if present). An alternate constructor that
accepts a boolean verify parameter should be used instead.
Description
