I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses. One of the misuses for which we could confirm the finding of the analysis, CogniCryptSAST is within this project.
The method getPreferredSSLContext sets the TrustManager to null. Thus the security depends on local configuration.
We hope that this report helps you and would be glad to get your thoughts on this issue.
I am reaching out to you as we conducted an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub. During our study, we randomly inspected a few of the misuses. One of the misuses for which we could confirm the finding of the analysis, CogniCryptSAST is within this project.
The method getPreferredSSLContext sets the TrustManager to null. Thus the security depends on local configuration.
We hope that this report helps you and would be glad to get your thoughts on this issue.