From 8c83844c31369ef96f851087c10ab0725e0fb0d0 Mon Sep 17 00:00:00 2001 From: Luis Presuel Date: Fri, 23 Feb 2024 13:59:38 -0600 Subject: [PATCH] Makes sure we are using a TLS secured version so golangci-lint does not break pipeline since current one is not secure. Fixes G402 - TLS MinVersion too low --- go.mod | 8 ++++---- go.sum | 8 ++++++++ pkg/venafi/cloud/cloud.go | 4 +++- pkg/venafi/firefly/firefly.go | 4 +++- pkg/venafi/tpp/tpp.go | 4 +++- 5 files changed, 21 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index 666f0ef0..e8c105a6 100644 --- a/go.mod +++ b/go.mod @@ -12,7 +12,7 @@ require ( github.com/urfave/cli/v2 v2.25.7 github.com/youmark/pkcs8 v0.0.0-20201027041543-1326539a0a0a go.uber.org/zap v1.23.0 - golang.org/x/crypto v0.11.0 + golang.org/x/crypto v0.19.0 golang.org/x/oauth2 v0.10.0 gopkg.in/ini.v1 v1.51.0 gopkg.in/yaml.v2 v2.4.0 @@ -40,9 +40,9 @@ require ( go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect golang.org/x/net v0.12.0 // indirect - golang.org/x/sys v0.10.0 // indirect - golang.org/x/term v0.10.0 // indirect - golang.org/x/text v0.11.0 // indirect + golang.org/x/sys v0.17.0 // indirect + golang.org/x/term v0.17.0 // indirect + golang.org/x/text v0.14.0 // indirect google.golang.org/appengine v1.6.7 // indirect google.golang.org/protobuf v1.31.0 // indirect ) diff --git a/go.sum b/go.sum index c52dac76..1897b636 100644 --- a/go.sum +++ b/go.sum @@ -225,6 +225,8 @@ golang.org/x/crypto v0.0.0-20190605123033-f99c8df09eb5/go.mod h1:yigFU9vqHzYiE8U golang.org/x/crypto v0.0.0-20200302210943-78000ba7a073/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.11.0 h1:6Ewdq3tDic1mg5xRO4milcWCfMVQhI4NkqWWvqejpuA= golang.org/x/crypto v0.11.0/go.mod h1:xgJhtzW8F9jGdVFWZESrid1U1bjeNy4zgy5cRr/CIio= +golang.org/x/crypto v0.19.0 h1:ENy+Az/9Y1vSrlrvBSyna3PITt4tiZLf7sgCjZBX7Wo= +golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDfU= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -285,13 +287,19 @@ golang.org/x/sys v0.0.0-20190624142023-c5567b49c5d0/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20191005200804-aed5e4c7ecf9/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.10.0 h1:SqMFp9UcQJZa+pmYuAKjd9xq1f0j5rLcDIk0mj4qAsA= golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.17.0 h1:25cE3gD+tdBA7lp7QfhuV+rJiE9YXTcS3VG1SqssI/Y= +golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.10.0 h1:3R7pNqamzBraeqj/Tj8qt1aQ2HpmlC+Cx/qL/7hn4/c= golang.org/x/term v0.10.0/go.mod h1:lpqdcUyK/oCiQxvxVrppt5ggO2KCZ5QblwqPnfZ6d5o= +golang.org/x/term v0.17.0 h1:mkTF7LCd6WGJNL3K1Ad7kwxNfYAW6a8a8QqtMblp/4U= +golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.11.0 h1:LAntKIrcmeSKERyiOh0XMV39LXS8IE9UL2yP7+f5ij4= golang.org/x/text v0.11.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180221164845-07fd8470d635/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= diff --git a/pkg/venafi/cloud/cloud.go b/pkg/venafi/cloud/cloud.go index eea389e6..79c3e51f 100644 --- a/pkg/venafi/cloud/cloud.go +++ b/pkg/venafi/cloud/cloud.go @@ -293,7 +293,9 @@ func (c *Connector) getHTTPClient() *http.Client { /* #nosec */ if c.trust != nil { if tlsConfig == nil { - tlsConfig = &tls.Config{} + tlsConfig = &tls.Config{ + MinVersion: tls.VersionTLS12, + } } else { tlsConfig = tlsConfig.Clone() } diff --git a/pkg/venafi/firefly/firefly.go b/pkg/venafi/firefly/firefly.go index 248a81c9..95c0ddf8 100644 --- a/pkg/venafi/firefly/firefly.go +++ b/pkg/venafi/firefly/firefly.go @@ -190,7 +190,9 @@ func (c *Connector) getHTTPClient() *http.Client { /* #nosec */ if c.trust != nil { if tlsConfig == nil { - tlsConfig = &tls.Config{} + tlsConfig = &tls.Config{ + MinVersion: tls.VersionTLS12, + } } else { tlsConfig = tlsConfig.Clone() } diff --git a/pkg/venafi/tpp/tpp.go b/pkg/venafi/tpp/tpp.go index 6a78df01..dc232e60 100644 --- a/pkg/venafi/tpp/tpp.go +++ b/pkg/venafi/tpp/tpp.go @@ -546,7 +546,9 @@ func (c *Connector) getHTTPClient() *http.Client { /* #nosec */ if c.trust != nil { if tlsConfig == nil { - tlsConfig = &tls.Config{} + tlsConfig = &tls.Config{ + MinVersion: tls.VersionTLS12, + } } else { tlsConfig = tlsConfig.Clone() }