contrib.dlint.dlint-equivalent.insecure-ssl-use

profile photo of returntocorpreturntocorp
Author
221
Download Count*
BSD 3-Clause "New" or "Revised" License
License

Weak or insecure 'ssl' module usage

Run Locally

Run in CI

Semgrep CI docs

Defintion

Edit RuleView Source
Open in Playground 
rules:
  - id: insecure-ssl-use
    message: Weak or insecure 'ssl' module usage
    languages:
      - python
    severity: WARNING
    metadata:
      source_rule_url: https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO122.md
      category: security
      technology:
        - python
      references:
        - https://github.com/dlint-py/dlint/blob/master/docs/linters/DUO122.md
      owasp:
        - A02:2021 - Cryptographic Failures
        - A03:2017 - Sensitive Data Exposure
      cwe:
        - "CWE-310: Cryptographic Issues"
      license: Commons Clause License Condition v1.0[LGPL-2.1-only]
    pattern-either:
      - pattern: ssl._create_unverified_context(...)
      - pattern: ssl._https_verify_certificates(enable=False)
      - pattern: ssl.CERT_NONE
      - pattern: ssl.CERT_OPTIONAL
      - pattern: ssl.PROTOCOL_SSLv2
      - pattern: ssl.PROTOCOL_SSLv23
      - pattern: ssl.PROTOCOL_SSLv3
      - pattern: ssl.PROTOCOL_TLS