.png){kind=logo}
sreeramadasugiri (Community Member) asked a question.
Dear Team,
Description: A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. Effort to Fix: 1 - Trivial implementation error. Fix is up to 5 lines of code. One hour or less to fix.
Recommendations: Do not support SSLv2 or weak SSL/TLS ciphers (i.e. 56-bit key length or less, or other inherent weaknesses).
My Java code is,
SSLContext sc = null;
try {
sc = SSLContext.getInstance("SSL"); -- error for CWE 757
logger.log(LogLevel.INFO, this.getClass().getName(), "SSL: "+sc);
} catch (NoSuchAlgorithmException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
I am getting CWE ID 757 error in the line "sc = SSLContext.getInstance("SSL");".
Can you help me to sort-out my issue.
Regards,
Giri
Hi @sreeramadasugiri (Community Member),
Veracode Static Analysis reports CWE 757 ('Algorithm Downgrade') here because the `SSLContext` being used potentially allows insecure algorithms. SSL, as well as TLS versions below 1.2, are considered insecure and should no longer be used. To fix the flaw, please specify TLSv1.2 explicitly via `SSLContext.getInstance("TLSv1.2");`.
Thank you,
Florian Walter
Hi Florian,
Thankyou for helping, now my issue has resolved after changing my code and build, tested it.
Regards,
Giri
Hi Giri, I'm happy to hear that!