New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Security Bug] Insecure crypto usage #49

Open

nageshservicenow opened this issue Mar 20, 2024 · 0 comments

nageshservicenow commented Mar 20, 2024

Description

Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks.

Used below verify mode.
..
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
..

Effected source files:

sensu-plugins-nginx/bin/check-nginx-status.rb

Line 93 in d251f3a

http.verify_mode = OpenSSL::SSL::VERIFY_NONE

sensu-plugins-nginx/bin/metrics-nginx.rb

Line 88 in d251f3a

http.verify_mode = OpenSSL::SSL::VERIFY_NONE

Remediation

Use 'OpenSSL::SSL::VERIFY_PEER' instead.

# for free to join this conversation on GitHub. Already have an account? # to comment