<!DOCTYPE qhelp PUBLIC

"-//Semmle//qhelp//EN"

"qhelp.dtd">

<qhelp>

<overview>

<p>

Using a broken or weak cryptographic protocol may make a connection

vulnerable to interference from an attacker.

</p>

</overview>

<recommendation>

<p>

Ensure that a modern, strong protocol is used. All versions of SSL,

and TLS 1.0 are known to be vulnerable to attacks. Using TLS 1.1 or

above is strongly recommended.

</p>

</recommendation>

<example>

<p>

The following code shows a variety of ways of setting up a

connection using SSL or TLS. They are all insecure because of the

version specified.

</p>

<sample src="examples/insecure_protocol.py" />

<p>

In all of the above cases, a secure protocol should be used instead.

</p>

<p>

Note that <code>ssl.wrap_socket</code> has been deprecated in

Python 3.7. A preferred alternative is to use

<code>ssl.SSLContext</code>, which is supported in Python 2.7.9 and

3.2 and later versions.

</p>

</example>

<references>

<li>Wikipedia: <a href="https://en.wikipedia.org/wiki/Transport_Layer_Security"> Transport Layer Security</a>.</li>

<li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.SSLContext"> class ssl.SSLContext</a>.</li>

<li>Python 3 documentation: <a href="https://docs.python.org/3/library/ssl.html#ssl.wrap_socket"> ssl.wrap_socket</a>.</li>

<li>pyOpenSSL documentation: <a href="https://pyopenssl.org/en/stable/api/ssl.html"> An interface to the SSL-specific parts of OpenSSL</a>.</li>

</references>

</qhelp>

import ssl

import socket

ssl.wrap_socket(socket.socket())

context = ssl.SSLContext()

import ssl

import socket

ssl.wrap_socket(socket.socket(), ssl_version=ssl.PROTOCOL_SSLv2)

context = ssl.SSLContext(ssl_version=ssl.PROTOCOL_SSLv3)

from pyOpenSSL import SSL

context = SSL.Context(SSL.TLSv1_METHOD)