Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

gosec high issue : G402 (CWE-295): TLS MinVersion too low. #1256

Closed
Aoang opened this issue Mar 18, 2022 · 3 comments
Closed

gosec high issue : G402 (CWE-295): TLS MinVersion too low. #1256

Aoang opened this issue Mar 18, 2022 · 3 comments

Comments

@Aoang
Copy link
Contributor

Aoang commented Mar 18, 2022

I updated 4657a76#diff-6102d4f2cddb56c446459bde9bf8e8044b87ce3f98a24c2bba99debfd62461dc in #1253 , and got high issue with gosec : G402 (CWE-295): TLS MinVersion too low.

To fix it, there are two options.

  1. set tls.Config.MinVersionis to tls.VersionTLS10 or higher
  2. gosec excluding rules G402

Well, what should we do ?
@erikdubbelboer
Copy link
Collaborator

Let's set tls.Config.MinVersionis to tls.VersionTLS10.

@Aoang
Copy link
Contributor Author

Aoang commented Mar 18, 2022

https://github.com/valyala/fasthttp/runs/5597612499?check_suite_focus=true

I tried. Maybe we should ignore. @erikdubbelboer

@erikdubbelboer
Copy link
Collaborator

I think it needs to be tls.VersionTLS12

u5surf pushed a commit to u5surf/fasthttp that referenced this issue Mar 23, 2022
@Aoang @u5surf
Add Go 1.18 support (valyala#1253)
4d07b0f 
* Add Go 1.18 support

* fix Gosec Security Scanner

https://github.com/valyala/fasthttp/runs/5595618634?check_suite_focus=true

* fix securego/gosec#469 (comment) Gosec Github Action Doesn't Work at Go 1.18

* fix golangci/golangci-lint#2438 golangci/golangci-lint Doesn't Work at Go 1.18

* fix golint unused

* fix golint: SA1019: netErr.Temporary is deprecated

* fix valyala#1256
u5surf pushed a commit to u5surf/fasthttp that referenced this issue Mar 23, 2022
@Aoang @u5surf
Add Go 1.18 support (valyala#1253)
9156bc3 
* Add Go 1.18 support

* fix Gosec Security Scanner

https://github.com/valyala/fasthttp/runs/5595618634?check_suite_focus=true

* fix securego/gosec#469 (comment) Gosec Github Action Doesn't Work at Go 1.18

* fix golangci/golangci-lint#2438 golangci/golangci-lint Doesn't Work at Go 1.18

* fix golint unused

* fix golint: SA1019: netErr.Temporary is deprecated

* fix valyala#1256
# for free to join this conversation on GitHub. Already have an account? # to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@erikdubbelboer @Aoang