Use of HTTP without TLS

[akondasif]

Greetings,

I am a security researcher, who is looking for security smells in Puppet scripts. I found instances where the HTTP protocol is used instead of HTTPS (HTTP with TLS). According to the Common Weakness Enumeration organization this is a security weakness (https://cwe.mitre.org/data/definitions/319.html). I was wondering why HTTP is used? Is it because of lack of tool support?

I am trying to find out if developers are forced to adopt bad practices due to lack of tool support when it comes to the HTTPS protocol. Maybe it is due to dependency on a resource that uses HTTP?

Any feedback is appreciated.

Source: https://github.com/theforeman/puppet-foreman/blob/master/manifests/repos/extra.pp (Line 16)

[ekohl]

I think we copied it from the default EPEL installation which is also over HTTP. Note that GPG-key is retrieved over HTTPS and is used to check integrity. I'm also not even sure yum uses baseurl if mirrorlist is given.

[akondasif]

Thanks for the quick reply.
I also assumed the same, due to lack of tool support the baseurl uses HTTP. Thanks for confirming.

[akondasif]

I am closing the issue, but please re-open the issue if you think further discussion is necessary.