From bb0dfa99f59e6c86c6dd6b72bd8fa025cb59ceed Mon Sep 17 00:00:00 2001 From: dextmorgn <64375473+dextmorgn@users.noreply.github.com> Date: Wed, 26 Aug 2026 00:36:02 +0200 Subject: [PATCH] fix(security): pin minimum TLS version in get_domain_from_ssl ssl.create_default_context() already excludes TLS1/1.1 by default in modern Python/OpenSSL, but CodeQL flags the implicit reliance on that default. Pin minimum_version explicitly instead of leaving it to library defaults. --- flowsint-core/src/flowsint_core/utils.py | 1 + flowsint-enrichers/src/flowsint_enrichers/utils.py | 1 + 2 files changed, 2 insertions(+) diff --git a/flowsint-core/src/flowsint_core/utils.py b/flowsint-core/src/flowsint_core/utils.py index 62dd2722..8e80510d 100644 --- a/flowsint-core/src/flowsint_core/utils.py +++ b/flowsint-core/src/flowsint_core/utils.py @@ -188,6 +188,7 @@ def extract_input_schema_flow(model: Type[BaseModel]) -> Dict[str, Any]: def get_domain_from_ssl(ip: str, port: int = 443) -> str | None: try: context = ssl.create_default_context() + context.minimum_version = ssl.TLSVersion.TLSv1_2 with socket.create_connection((ip, port), timeout=3) as sock: with context.wrap_socket(sock, server_hostname=ip) as ssock: cert = ssock.getpeercert() diff --git a/flowsint-enrichers/src/flowsint_enrichers/utils.py b/flowsint-enrichers/src/flowsint_enrichers/utils.py index c8f2d670..d6225efa 100644 --- a/flowsint-enrichers/src/flowsint_enrichers/utils.py +++ b/flowsint-enrichers/src/flowsint_enrichers/utils.py @@ -240,6 +240,7 @@ def extract_input_schema_flow(model: Type[BaseModel]) -> Dict[str, Any]: def get_domain_from_ssl(ip: str, port: int = 443) -> str | None: try: context = ssl.create_default_context() + context.minimum_version = ssl.TLSVersion.TLSv1_2 with socket.create_connection((ip, port), timeout=3) as sock: with context.wrap_socket(sock, server_hostname=ip) as ssock: cert = ssock.getpeercert()