{"@ID": "744", "@Name": "CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)", "@Status": "Obsolete", "Summary": "Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).", "Relationships": {"Has_Member": [{"@CWE_ID": "119", "@View_ID": "734"}, {"@CWE_ID": "426", "@View_ID": "734"}, {"@CWE_ID": "462", "@View_ID": "734"}, {"@CWE_ID": "705", "@View_ID": "734"}, {"@CWE_ID": "78", "@View_ID": "734"}, {"@CWE_ID": "88", "@View_ID": "734"}]}, "References": {"Reference": {"@External_Reference_ID": "REF-597"}}, "Mapping_Notes": {"Usage": "Prohibited", "Rationale": "This entry is a Grouping. Using groupings for mapping has been discouraged since 2019. They are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "Comments": "See member weaknesses of this category.", "Reasons": {"Reason": {"@Type": "Grouping"}}}, "Notes": {"Note": {"@Type": "Relationship", "xhtml:p": "In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "xhtml:ul": {"xhtml:li": ["CWE-78 ENV03-C Sanitize the environment when invoking external programs", "CWE-78 ENV04-C Do not call system() if you do not need a command processor", "CWE-88 ENV03-C Sanitize the environment when invoking external programs", "CWE-88 ENV04-C Do not call system() if you do not need a command processor", "CWE-119 ENV01-C Do not make assumptions about the size of an environment variable", "CWE-426 ENV03-C Sanitize the environment when invoking external programs", "CWE-462 ENV02-C Beware of multiple environment variables with the same effective name", "CWE-705 ENV32-C All atexit handlers must return normally"]}, "#text_blocks": ["In the 2008 version of the CERT C Secure Coding standard, the following rules were mapped to the following CWE IDs:", "CWE-78 ENV03-C Sanitize the environment when invoking external programs", "CWE-78 ENV04-C Do not call system() if you do not need a command processor", "CWE-88 ENV03-C Sanitize the environment when invoking external programs", "CWE-88 ENV04-C Do not call system() if you do not need a command processor", "CWE-119 ENV01-C Do not make assumptions about the size of an environment variable", "CWE-426 ENV03-C Sanitize the environment when invoking external programs", "CWE-462 ENV02-C Beware of multiple environment variables with the same effective name", "CWE-705 ENV32-C All atexit handlers must return normally"]}}, "Content_History": {"Submission": {"Submission_Name": "CWE Content Team", "Submission_Organization": "MITRE", "Submission_Date": "2008-11-24", "Submission_Version": "1.1", "Submission_ReleaseDate": "2008-11-24"}, "Modification": [{"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2017-11-08", "Modification_Version": "3.0", "Modification_ReleaseDate": "2017-11-08", "Modification_Comment": "updated Description, Name, Relationship_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2019-01-03", "Modification_Version": "3.2", "Modification_ReleaseDate": "2019-01-03", "Modification_Comment": "updated Description, Name, References"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-04-27", "Modification_Version": "4.11", "Modification_ReleaseDate": "2023-04-27", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2023-06-29", "Modification_Version": "4.12", "Modification_ReleaseDate": "2023-06-29", "Modification_Comment": "updated Mapping_Notes"}, {"Modification_Name": "CWE Content Team", "Modification_Organization": "MITRE", "Modification_Date": "2026-10-28", "Modification_Version": "5.0", "Modification_ReleaseDate": "2026-10-28", "Modification_Comment": "updated Mapping_Notes, Type"}], "Previous_Entry_Name": [{"@Date": "2017-11-08", "#text": "CERT C Secure Coding Section 10 - Environment (ENV)"}, {"@Date": "2019-01-03", "#text": "CERT C Secure Coding (2008 Version) Section 10 - Environment (ENV)"}]}, "entry_type": "Grouping"}