CWE-1291Base

Public Key Re-Use for Signing both Debug and Production Code

Draft in the CWE catalog · 1 CVE mapped

1
CVEs mapped
8.2
Median CVSS
What it is

The same public key is used for signing both debug and production code.

Recent examples
8.2cvss
CVE-2022-1665

CVE-2022-1665 - HIGH Severity Vulnerability

A set of pre-production kernel packages of Red Hat Enterprise Linux for IBM Power architecture can be booted by the grub in Secure Boot mode even though it shouldn't. These kernel builds don't have the secure boot lockdown patches applied to it and can bypass the secure boot validations, allowing the attacker to load another non-trusted code.

HIGHno explanation yet
0%
epss
The record
Technical detail
CWE ID
CWE-1291
Abstraction
Base
Structure
Simple
Status
Draft