InsecureProtocol.qhelp

<!DOCTYPE qhelp PUBLIC
"-//Semmle//qhelp//EN"
"qhelp.dtd">
<qhelp>
     <overview>
          <p>
            Using a broken or weak cryptographic protocol may make a connection
            vulnerable to interference from an attacker.
          </p>

     </overview>
     <recommendation>

          <p>
            Ensure that a modern, strong protocol is used. All versions of SSL,
            and TLS 1.0 are known to be vulnerable to attacks. Using TLS 1.1 or
            above is strongly recommended.
          </p>

     </recommendation>
     <example>

          <p>
            The following code shows a variety of ways of setting up a
            connection using SSL or TLS. They are all insecure because of the
            version specified.
          </p>

          <sample src="examples/insecure_protocol.py" />

          <p>
            In all of the above cases, a secure protocol should be used instead.
          </p>
          <p>
            Note that <code>ssl.wrap_socket</code> has been deprecated in
            Python 3.7. A preferred alternative is to use
            <code>ssl.SSLContext</code>, which is supported in Python 2.7.9 and
            3.2 and later versions.
          </p>
     </example>

     <references>
       <li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security"> Transport Layer Security</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.SSLContext"> class ssl.SSLContext</a>.</li>
       <li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.wrap_socket"> ssl.wrap_socket</a>.</li>
       <li>pyOpenSSL documentation: <a href="https://pyopenssl.org/en/stable/api/ssl.html"> An interface to the SSL-specific parts of OpenSSL</a>.</li>
     </references>

</qhelp>