CWE-295
AllowedImproper Certificate Validation
Abstraction: Base · Status: Draft
The product does not validate, or incorrectly validates, a certificate.
1914 vulnerabilities reference this CWE, most recent first.
GHSA-FQ9F-9WV9-RFMG
Vulnerability from github – Published: 2022-05-14 01:04 – Updated: 2022-07-01 21:56Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins plugins. The fix for CVE-2012-6153 was backported to the version of commons-httpclient that is bundled in core and made available to plugins.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.73.1"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.73.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.83"
},
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.main:jenkins-core"
},
"ranges": [
{
"events": [
{
"introduced": "2.74"
},
{
"fixed": "2.84"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2017-1000396"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-01T21:56:10Z",
"nvd_published_at": "2018-01-26T02:29:00Z",
"severity": "MODERATE"
},
"details": "Jenkins 2.73.1 and earlier, 2.83 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. This library is widely used as a transitive dependency in Jenkins plugins. The fix for CVE-2012-6153 was backported to the version of commons-httpclient that is bundled in core and made available to plugins.",
"id": "GHSA-fq9f-9wv9-rfmg",
"modified": "2022-07-01T21:56:10Z",
"published": "2022-05-14T01:04:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-1000396"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/jenkins/commit/fe77d1c3dbf91ddf2a9f8e5ed882611455ab00d0"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/jenkins"
},
{
"type": "WEB",
"url": "https://jenkins.io/security/advisory/2017-10-11"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Improper Certificate Validation in Jenkins"
}
GHSA-FQ9Q-HXWP-WW2G
Vulnerability from github – Published: 2022-05-13 01:11 – Updated: 2022-05-13 01:11Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.
{
"affected": [],
"aliases": [
"CVE-2016-4830"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-04-21T14:59:00Z",
"severity": "MODERATE"
},
"details": "Sushiro App for iOS 2.1.16 and earlier and Sushiro App for Android 2.1.16.1 and earlier do not verify SSL certificates.",
"id": "GHSA-fq9q-hxwp-ww2g",
"modified": "2022-05-13T01:11:17Z",
"published": "2022-05-13T01:11:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-4830"
},
{
"type": "WEB",
"url": "http://jvn.jp/en/jp/JVN30260727/index.html"
},
{
"type": "WEB",
"url": "http://jvndb.jvn.jp/en/contents/2016/JVNDB-2016-000122.html"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/91490"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FRR6-4W4R-WRWV
Vulnerability from github – Published: 2024-08-12 15:30 – Updated: 2024-08-12 15:30Ecosystem Agent version 4 < 4.5.1.2597 and Ecosystem Agent version 5 < 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position.
{
"affected": [],
"aliases": [
"CVE-2024-5445"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-12T13:38:37Z",
"severity": "LOW"
},
"details": "Ecosystem Agent version 4 \u003c 4.5.1.2597 and Ecosystem Agent version 5 \u003c 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position.",
"id": "GHSA-frr6-4w4r-wrwv",
"modified": "2024-08-12T15:30:51Z",
"published": "2024-08-12T15:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5445"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-Version-in-N-sight"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/article/How-to-check-Ecosystem-Agent-version-in-N-central"
},
{
"type": "WEB",
"url": "https://me.n-able.com/s/security-advisory/aArVy0000000BhpKAE/cve20245445-ecosystem-agent-insufficient-transport-layer-security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FV83-X2XW-2J55
Vulnerability from github – Published: 2026-04-08 03:32 – Updated: 2026-07-21 12:32When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
{
"affected": [],
"aliases": [
"CVE-2026-33810"
],
"database_specific": {
"cwe_ids": [
"CWE-1289",
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-08T02:16:03Z",
"severity": "HIGH"
},
"details": "When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.",
"id": "GHSA-fv83-x2xw-2j55",
"modified": "2026-07-21T12:32:54Z",
"published": "2026-04-08T03:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:28047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:29854"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:34365"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36651"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:39810"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40118"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40945"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42043"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42047"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42049"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42050"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:42051"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:7291"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"type": "WEB",
"url": "https://go.dev/cl/763763"
},
{
"type": "WEB",
"url": "https://go.dev/issue/78332"
},
{
"type": "WEB",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33810.json"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10155"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:10158"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:14391"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19135"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19144"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19353"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19719"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19720"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:19721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21769"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:21772"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22347"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22485"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22958"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22959"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22960"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22961"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:22962"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:24478"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:25089"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:26571"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/19/4"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/04/20/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FVVH-QMRH-FP83
Vulnerability from github – Published: 2022-06-15 00:00 – Updated: 2022-06-24 00:00'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
{
"affected": [],
"aliases": [
"CVE-2022-29482"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-06-14T09:15:00Z",
"severity": "MODERATE"
},
"details": "\u0027Mobaoku-Auction\u0026Flea Market\u0027 App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.",
"id": "GHSA-fvvh-qmrh-fp83",
"modified": "2022-06-24T00:00:33Z",
"published": "2022-06-15T00:00:24Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29482"
},
{
"type": "WEB",
"url": "https://jvn.jp/en/jp/JVN13878856/index.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FVWQ-3PCX-4FVR
Vulnerability from github – Published: 2022-05-24 17:26 – Updated: 2022-05-24 17:26MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.
{
"affected": [],
"aliases": [
"CVE-2020-12619"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-08-20T23:15:00Z",
"severity": "MODERATE"
},
"details": "MailMate before 1.11 automatically imported S/MIME certificates and thereby silently replaced existing ones. This allowed a man-in-the-middle attacker to obtain an email-validated S/MIME certificate from a trusted CA and replace the public key of the entity to be impersonated. This enabled the attacker to decipher further communication. The entire attack could be accomplished by sending a single email.",
"id": "GHSA-fvwq-3pcx-4fvr",
"modified": "2022-05-24T17:26:17Z",
"published": "2022-05-24T17:26:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12619"
},
{
"type": "WEB",
"url": "https://updates.mailmate-app.com/2.0/release_notes"
},
{
"type": "WEB",
"url": "https://www.nds.ruhr-uni-bochum.de/media/nds/veroeffentlichungen/2020/08/15/mailto-paper.pdf"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FW35-7JFQ-3G5M
Vulnerability from github – Published: 2022-05-24 17:30 – Updated: 2022-05-24 17:30When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certificates which could allow a malicious network-based user to access unauthorized data. This issue affects all Juniper Networks Mist Cloud UI versions prior to September 2 2020.
{
"affected": [],
"aliases": [
"CVE-2020-1675"
],
"database_specific": {
"cwe_ids": [
"CWE-287",
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-10-16T21:15:00Z",
"severity": "HIGH"
},
"details": "When Security Assertion Markup Language (SAML) authentication is enabled, Juniper Networks Mist Cloud UI might incorrectly process invalid authentication certificates which could allow a malicious network-based user to access unauthorized data. This issue affects all Juniper Networks Mist Cloud UI versions prior to September 2 2020.",
"id": "GHSA-fw35-7jfq-3g5m",
"modified": "2022-05-24T17:30:52Z",
"published": "2022-05-24T17:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1675"
},
{
"type": "WEB",
"url": "https://kb.juniper.net/JSA11072"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FWHW-H3P7-GX3Q
Vulnerability from github – Published: 2025-03-19 03:30 – Updated: 2025-03-19 03:30Improper certificate validation vulnerability in the update functionality in Synology BeeStation Manager (BSM) before 1.1-65374, Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to write limited files via unspecified vectors.
{
"affected": [],
"aliases": [
"CVE-2024-10445"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-19T02:15:28Z",
"severity": "MODERATE"
},
"details": "Improper certificate validation vulnerability in the update functionality in Synology BeeStation Manager (BSM) before 1.1-65374, Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.1.1-42962-7, 7.2-64570-4, 7.2.1-69057-6 and 7.2.2-72806-1 and Synology Unified Controller (DSMUC) before 3.1.4-23079 allows remote attackers to write limited files via unspecified vectors.",
"id": "GHSA-fwhw-h3p7-gx3q",
"modified": "2025-03-19T03:30:35Z",
"published": "2025-03-19T03:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10445"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_20"
},
{
"type": "WEB",
"url": "https://www.synology.com/en-global/security/advisory/Synology_SA_24_23"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWWQ-W4X9-PP7R
Vulnerability from github – Published: 2022-05-14 03:07 – Updated: 2022-05-14 03:07PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.
{
"affected": [],
"aliases": [
"CVE-2018-10377"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-06-17T16:29:00Z",
"severity": "MODERATE"
},
"details": "PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-the-middle attackers to obtain interaction data.",
"id": "GHSA-fwwq-w4x9-pp7r",
"modified": "2022-05-14T03:07:22Z",
"published": "2022-05-14T03:07:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10377"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/337680"
},
{
"type": "WEB",
"url": "https://integritylabs.io/advisories/cve-2018-10377"
},
{
"type": "WEB",
"url": "http://releases.portswigger.net/2018/06/1734.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FX8R-3HMX-C78J
Vulnerability from github – Published: 2022-05-24 19:17 – Updated: 2022-05-24 19:17LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.
{
"affected": [],
"aliases": [
"CVE-2021-25633"
],
"database_specific": {
"cwe_ids": [
"CWE-295"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-10-11T17:15:00Z",
"severity": "HIGH"
},
"details": "LibreOffice supports digital signatures of ODF documents and macros within documents, presenting visual aids that no alteration of the document occurred since the last signing and that the signature is valid. An Improper Certificate Validation vulnerability in LibreOffice allowed an attacker to create a digitally signed ODF document, by manipulating the documentsignatures.xml or macrosignatures.xml stream within the document to combine multiple certificate data, which when opened caused LibreOffice to display a validly signed indicator but whose content was unrelated to the signature shown. This issue affects: The Document Foundation LibreOffice 7-0 versions prior to 7.0.6; 7-1 versions prior to 7.1.2.",
"id": "GHSA-fx8r-3hmx-c78j",
"modified": "2022-05-24T19:17:09Z",
"published": "2022-05-24T19:17:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25633"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2021/dsa-4988"
},
{
"type": "WEB",
"url": "https://www.libreoffice.org/about-us/security/advisories/CVE-2021-25633"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Mitigation
If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
CAPEC-459: Creating a Rogue Certification Authority Certificate
An adversary exploits a weakness resulting from using a hashing algorithm with weak collision resistance to generate certificate signing requests (CSR) that contain collision blocks in their "to be signed" parts. The adversary submits one CSR to be signed by a trusted certificate authority then uses the signed blob to make a second certificate appear signed by said certificate authority. Due to the hash collision, both certificates, though different, hash to the same value and so the signed blob works just as well in the second certificate. The net effect is that the adversary's second X.509 certificate, which the Certification Authority has never seen, is now signed and validated by that Certification Authority.
CAPEC-475: Signature Spoofing by Improper Validation
An adversary exploits a cryptographic weakness in the signature verification algorithm implementation to generate a valid signature without knowing the key.