InsecureProtocol.qhelp

<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
     <overview>
          <p>
            Using a broken or weak cryptographic protocol may make a connection
            vulnerable to interference from an attacker.
          </p>

     </overview>
     <recommendation>

          <p>
            Ensure that a modern, strong protocol is used. All versions of SSL,
            and TLS versions 1.0 and 1.1 are known to be vulnerable to attacks.
            Using TLS 1.2 or above is strongly recommended.
          </p>

     </recommendation>
     <example>

          <p>
            The following code shows a variety of ways of setting up a
            connection using SSL or TLS. They are all insecure because of the
            version specified.
          </p>

          <sample src="examples/insecure_protocol.py" />

          <p>
            All cases should be updated to use a secure protocol, such as
            <code>PROTOCOL_TLSv1_2</code>.
          </p>
          <p>
            Note that <code>ssl.wrap_socket</code> has been deprecated in
            Python 3.7. The recommended alternatives are:
          </p>
          <ul>
            <li><code>ssl.SSLContext</code> - supported in Python 2.7.9,
                  3.2, and later versions</li>
            <li><code>ssl.create_default_context</code> - a convenience function,
                  supported in Python 3.4 and later versions.</li>
          </ul>
          <p>
            Even when you use these alternatives, you should
            ensure that a safe protocol is used. The following code illustrates
            how to use flags (available since Python 3.2) or the `minimum_version`
            field (favored since Python 3.7) to restrict the protocols accepted when
            creating a connection.
          </p>

          <sample src="examples/secure_default_protocol.py" />
     </example>

     <references>
       <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security"> Transport Layer Security</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.SSLContext"> class ssl.SSLContext</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.wrap_socket"> ssl.wrap_socket</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#functions-constants-and-exceptions"> notes on context creation</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl-security"> notes on security considerations</a>.</li>
       <li>pyOpenSSL documentation: <a href="https://pyopenssl.org/en/stable/api/ssl.html"> An interface to the SSL-specific parts of OpenSSL</a>.</li>
     </references>

</qhelp>