2021-04-26 17:29:13 +02:00
include::../description.adoc[]
2021-02-02 15:02:10 +01:00
2021-04-26 17:29:13 +02:00
== Noncompliant Code Example
2020-06-30 12:49:37 +02:00
2021-04-26 17:29:13 +02:00
``++javax.net.ssl.SSLContext++`` library:
2021-02-02 15:02:10 +01:00
2021-04-26 17:29:13 +02:00
----
context = SSLContext.getInstance("TLSv1.1"); // Noncompliant
----
2020-06-30 12:49:37 +02:00
2021-04-26 17:29:13 +02:00
https://square.github.io/okhttp/[okhttp] library:
2021-02-02 15:02:10 +01:00
2021-04-26 17:29:13 +02:00
----
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_1) // Noncompliant
.build();
----
2020-06-30 12:49:37 +02:00
2021-04-26 17:29:13 +02:00
== Compliant Solution
``++javax.net.ssl.SSLContext++`` library:
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
context = SSLContext.getInstance("TLSv1.2"); // Compliant
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
https://square.github.io/okhttp/[okhttp] library:
2020-06-30 12:49:37 +02:00
----
2021-04-26 17:29:13 +02:00
ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
.tlsVersions(TlsVersion.TLS_1_2) // Compliant
.build();
2020-06-30 12:49:37 +02:00
----
2021-02-18 15:34:22 +01:00
== See
* https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
* https://www.owasp.org/index.php/Top_10-2017_A6-Security_Misconfiguration[OWASP Top 10 2017 Category A6] - Security Misconfiguration
* https://cwe.mitre.org/data/definitions/326.html[MITRE, CWE-327] - Inadequate Encryption Strength
* https://cwe.mitre.org/data/definitions/327.html[MITRE, CWE-326] - Use of a Broken or Risky Cryptographic Algorithm
* https://www.sans.org/top25-software-errors/#cat3[SANS Top 25] - Porous Defenses
* https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https[Diagnosing TLS, SSL, and HTTPS]
* https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#22-use-secure-protocols[SSL and TLS Deployment Best Practices - Use secure protocols]
