Skip to content

ssl-insecure-version (S502)#

Derived from the flake8-bandit linter.

What it does#

Checks for function calls with parameters that indicate the use of insecure SSL and TLS protocol versions.

Why is this bad?#

Several highly publicized exploitable flaws have been discovered in all versions of SSL and early versions of TLS. The following versions are considered insecure, and should be avoided:

  • SSL v2
  • SSL v3
  • TLS v1
  • TLS v1.1

This method supports detection on the Python's built-in ssl module and the pyOpenSSL module.

Example#

import ssl

ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1)

Use instead:

import ssl

ssl.wrap_socket(ssl_version=ssl.PROTOCOL_TLSv1_2)