mirror of
https://github.com/github/codeql.git
synced 2025-12-30 07:36:34 +01:00
605bd19306
Reading over the description at https://cwe.mitre.org/data/definitions/328.html: > The product uses a hashing algorithm that produces a hash value that can be used to determine the original input, or to find an input that can produce the same hash, more efficiently than brute force techniques. For the data that does not require computationally expensive hashing, that will be the exactly problems that this query finds 👍 (that is, MD5, SHA1)
Current status (Feb 2021)
This should be kept up to date; the world is moving fast and protocols are being broken.
Protocols
- All versions of SSL are insecure
- TLS 1.0 and TLS 1.1 are insecure
- TLS 1.2 have some issues. but TLS 1.3 is not widely supported
Conection methods
ssl.wrap_socketis creating insecure connections, useSSLContext.wrap_socketinstead. linkDeprecated since version 3.7: Since Python 3.2 and 2.7.9, it is recommended to use the
SSLContext.wrap_socket()instead ofwrap_socket(). The top-level function is limited and creates an insecure client socket without server name indication or hostname matching.- Default constructors are fine, a fluent API is used to constrain possible protocols later.
Current recomendation
TLS 1.2 or TLS 1.3
Queries
InsecureProtocoldetects uses of insecure protocols.InsecureDefaultProtocoldetect default constructions, this is no longer unsafe.