merge in release/0.9.4 - #1
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| context.verify_mode = msg.get('ssl_verify', ssl.CERT_REQUIRED) | ||
| with probe_tcp(msg, close=False) as connection: | ||
| try: | ||
| with context.wrap_socket( |
Check failure
Code scanning / CodeQL
Use of insecure SSL/TLS version High
Show autofix suggestion
Hide autofix suggestion
Copilot Autofix
AI 12 months ago
The best way to address this issue is to ensure that the SSL context (ssl.SSLContext) used in probe_ssl() explicitly disallows insecure protocols. The most direct approach, supported in Python 3.7 and newer, is to set context.minimum_version = ssl.TLSVersion.TLSv1_2. This forcibly disables TLS versions prior to 1.2, guaranteeing only secure protocols are negotiated. For older Python versions, you would add context options to turn off older protocols, but since the file uses create_default_context() (introduced in 3.4) and can be reasonably expected to run on modern Pythons, setting minimum_version is best. The change should be applied in probe_ssl(), after the context is created (after line 92, on a new line before context.verify_mode = ...). No new imports are required.
| @@ -90,6 +90,7 @@ | ||
| def probe_ssl(msg): | ||
| hostname = msg.get('hostname') or msg.get('dst') | ||
| context = ssl.create_default_context() | ||
| context.minimum_version = ssl.TLSVersion.TLSv1_2 | ||
| context.verify_mode = msg.get('ssl_verify', ssl.CERT_REQUIRED) | ||
| with probe_tcp(msg, close=False) as connection: | ||
| try: |
2 participants
No description provided.