CodeQL documentation
CodeQL resources

boost::asio TLS settings misconfiguration

ID: cpp/boost/tls-settings-misconfiguration Kind: problem Security severity: 7.5 Severity: error Precision: medium Tags: - security - external/cwe/cwe-326 Query suites: - cpp-security-extended.qls - cpp-security-and-quality.qls

Click to see the query in the CodeQL repository

Using the TLS or SSLv23 protocol from the boost::asio library, but not disabling deprecated protocols may expose the software to known vulnerabilities or permit weak encryption algorithms to be used. Disabling the minimum-recommended protocols is also flagged.

Recommendation

When using the TLS or SSLv23 protocol, set the no_tlsv1 and no_tlsv1_1 options, but do not set no_tlsv1_2. When using the SSLv23 protocol, also set the no_sslv3 option.

Example

In the following example, the no_tlsv1_1 option has not been set. Use of TLS 1.1 is not recommended.

voiduseTLS_bad(){boost::asio::ssl::contextctx(boost::asio::ssl::context::tls);ctx.set_options(boost::asio::ssl::context::no_tlsv1);// BAD: missing no_tlsv1_1// ...}

In the corrected example, the no_tlsv1 and no_tlsv1_1 options have both been set, ensuring the use of TLS 1.2 or later.

voiduseTLS_good(){boost::asio::ssl::contextctx(boost::asio::ssl::context::tls);ctx.set_options(boost::asio::ssl::context::no_tlsv1|boost::asio::ssl::context::no_tlsv1_1);// GOOD// ...}

References

close