On Python versions earlier than 2.7.9 and 3.4.3, standard libraries that perform HTTPS request have a vulnerable SSL/TLS configuration by default. In the past, it has led to the following vulnerabilities:
By default, those library would simply ignore verification of X509 certificate signatures, as well as hostname verification. This mean that nothing is preventing an attacker to intercept network traffic. He would then be able to read and modify sensitive information that should normally be safe from this threat.
This rule raises an issue when one of the following standard library is used for networking with its default SSL/TLS configuration: ``++urllib++``, ``++urllib++``, ``++http++`` or ``++httplib++``.
== Ask Yourself Whether
* Your application is using _urllib_, _urllib2_, _http_, and _httplib_ modules to perform HTTPS requests
* You rely on the library default SSL/TLS configuration.
* You are using a version of Python prior to 2.7.9 or 3.4.3.
You are at risk if you answered yes to all those questions.
== Recommended Secure Coding Practices
* Avoid versions of Python where standard library have vulnerable SSL/TLS configuration by default. Your Python version should be at least 2.7.9 or 3.4.3.
* Prefer using http://requests.readthedocs.org/[Requests package] which has secure SSL/TLS configuration by default.
* https://www.owasp.org/index.php/Top_10-2017_A3-Sensitive_Data_Exposure[OWASP Top 10 2017 Category A3] - Sensitive Data Exposure
* https://www.owasp.org/index.php/Top_10-2017_A9-Using_Components_with_Known_Vulnerabilities[OWASP Top 10 2017 Category A9] - Using Components with Known Vulnerabilities
