SecOps #1414: [Sécurité] Vulnérabilité de code : internal/rest/client/http_client.go:82 (go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion) - Qwarks Connect - Redmine

Actions

SecOps #1414

open

[Sécurité] Vulnérabilité de code : internal/rest/client/http_client.go:82 (go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)

SecOps #1414: [Sécurité] Vulnérabilité de code : internal/rest/client/http_client.go:82 (go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)

Added by Client Dashboard 20 days ago. Updated 11 days ago.

Status:

Submitted

Priority:

Normal

Assignee:

Start date:

07/15/2026

Due date:

% Done:

Estimated time:

spec_ref:

build_status:

build_number:

ci_run_url:

scan_status:

scan_report_url:

deploy_status:

preprod_url:

deployed_at:

branch:

pr_url:

security_key:

internal/rest/client/http_client.go:82_go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion

severity:

medium

paused:

Description

**Sévérité** : MEDIUM
**Source** : Semgrep
`vuln-medium`
**Emplacement** : internal/rest/client/http_client.go:82
**Règle** : go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.

### Extrait de code
```
requires login
```

### Lien CVE
https://go.dev/doc/go1.22#minor_library_changes

### Recommandations
tls.Config{ InsecureSkipVerify: true, MinVersion: tls.VersionTLS13 }

CD Updated by Client Dashboard 20 days ago Actions
Copy link
#1

Vulnérabilité `internal/rest/client/http_client.go:82_go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion` à nouveau détectée par un scan ; ticket déjà ouvert (aucun doublon créé).