Merge pull request #3041 from airween/v3/remoterulestls

Marc Stern · web-flow · commit a859574bf20a · 2024-01-30T11:16:05.000+01:00
Set the minimum security protocol version for SecRemoteRules
diff --git a/CHANGES b/CHANGES
@@ -1,6 +1,8 @@
 v3.x.y - YYYY-MMM-DD (to be released)
 -------------------------------------
 
+  - Set the minimum security protocol version for SecRemoteRules
+    [Issue security/code-scanning/2 - @airween]
 
 v3.0.11 - 2023-Dec-06
 ---------------------
diff --git a/src/utils/https_client.cc b/src/utils/https_client.cc
@@ -87,8 +87,8 @@ bool HttpsClient::download(const std::string &uri) {
         headers_chunk = curl_slist_append(headers_chunk, m_key.c_str());
     }
 
-    /* Make it TLS 1.x only. */
-    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);
+    /* Make it TLS 1.2 at least. */
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
 
     /* those are the default options, but lets make sure */
     curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);

Original file line number	Diff line number	Diff line change
`@@ -87,8 +87,8 @@ bool HttpsClient::download(const std::string &uri) {`
`87`	`87`	`headers_chunk = curl_slist_append(headers_chunk, m_key.c_str());`
`88`	`88`	`}`
`89`	`89`
`90`		`- /* Make it TLS 1.x only. */`
`91`		`- curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1);`
	`90`	`+ /* Make it TLS 1.2 at least. */`
	`91`	`+ curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);`
`92`	`92`
`93`	`93`	`/* those are the default options, but lets make sure */`
`94`	`94`	`curl_easy_setopt(curl, CURLOPT_SSL_VERIFYPEER, 1);`