Project

General

Profile

Actions
Copy link

SecOps #1414

open
« Previous | Next »
CD

[Sécurité] Vulnérabilité de code : internal/rest/client/http_client.go:82 (go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)

SecOps #1414: [Sécurité] Vulnérabilité de code : internal/rest/client/http_client.go:82 (go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion)

Added by Client Dashboard 20 days ago. Updated 11 days ago.

Status:
Submitted
Priority:
Normal
Assignee:
-
Start date:
07/15/2026
Due date:
% Done:

0%

Estimated time:
spec_ref:
build_status:
build_number:
ci_run_url:
scan_status:
scan_report_url:
deploy_status:
preprod_url:
deployed_at:
branch:
pr_url:
security_key:
internal/rest/client/http_client.go:82_go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion
severity:
medium
paused:

Description

**Sévérité** : MEDIUM
**Source** : Semgrep
`vuln-medium`
**Emplacement** : internal/rest/client/http_client.go:82
**Règle** : go.lang.security.audit.crypto.missing-ssl-minversion.missing-ssl-minversion

`MinVersion` is missing from this TLS configuration. By default, as of Go 1.22, TLS 1.2 is currently used as the minimum. General purpose web applications should default to TLS 1.3 with all other protocols disabled. Only where it is known that a web server must support legacy clients with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support. Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.

### Extrait de code
```
requires login
```

### Lien CVE
https://go.dev/doc/go1.22#minor_library_changes

### Recommandations
tls.Config{ InsecureSkipVerify: true, MinVersion: tls.VersionTLS13 }

Actions
Copy link

Also available in: PDF Atom