Skip to content

Inadequate encryption strength

Description

DefaultHttpClient with default constructor is not compatible with TLS 1.2

Examples

Insecure Code

scala
val client = new DefaultHttpClient()

Secure Code

scala
val client = HttpClientBuilder.create().build()

Remediation

Use the HttpClientBuilder to create an instance of CloseableHttpClient with TLS 1.2 support

Rule Details

FieldValue
IDCODE-0024
CategoryInsecureConfig
SeverityMEDIUM
CWECWE-326
ConfidenceHIGH
ImpactMEDIUM
LikelihoodMEDIUM
ExploitabilityMODERATE
TagsTLS, encryption
OWASPN/A