Skip to content

Files

Latest commit

 

History

History
44 lines (29 loc) · 1.46 KB

B504.md

File metadata and controls

44 lines (29 loc) · 1.46 KB

Pattern: Use of insecure SSL/TLS as default method value

Issue: -

Description

Several highly publicized exploitable flaws have been discovered in all versions of SSL and early versions of TLS. It is strongly recommended that use of the following known broken protocol versions be avoided:

  • SSL v2
  • SSL v3
  • TLS v1
  • TLS v1.1

This rule scans for specific methods in Python's native SSL/TLS support and the pyOpenSSL module that configure the version of SSL/TLS protocol to use. These methods are known to provide default value that maximize compatibility, but permit use of the aforementioned broken protocol versions.

Example of insecure code:

import ssl
from pyOpenSSL import SSL

ssl.wrap_socket()

Example of secure code:

import ssl
from pyOpenSSL import SSL

ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_2)

When using SSLv23 it is important to also provide flags to explicitly exclude bad versions of SSL/TLS from the protocol versions considered. Both the Python native and pyOpenSSL modules provide the OP_NO_SSLv2 and OP_NO_SSLv3 flags for this purpose.

Further Reading