JFrog CLI Build - Upgrade Go to v1.23.2

[eyalbe4]

Depends on jfrog/.github#5 for the Static Analysis / Go-Sec ubuntu-latest (pull_request) check to pass.

[github-actions]

---

🐸 JFrog Frogbot

[github-actions]

{InsecureSkipVerify: true}

at artifactory_test.go (line 1770)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
High	Insecure TLS Configuration

Full description

Overview

Insecure TLS Configuration is a type of vulnerability that occurs when an
application uses weak or outdated cryptographic protocols, ciphers, or
configurations for secure communication over the network.

Vulnerable example

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
        config.MinVersion = 0
    }
    {
        config := &tls.Config{}
        config.MinVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
        config.MaxVersion = tls.VersionSSL30
    }
    {
        config := &tls.Config{}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
            tls.TLS_RSA_WITH_RC4_128_SHA,
        },
    }
    _ = config
}

In this example, the MinVersion field is set to tls.VersionSSL30, which
uses the outdated SSL 3.0 protocol, making the application vulnerable to
attacks such as POODLE.

Remediation

package main

import (
    "crypto/tls"
)

func main() {}

func insecureMinMaxTlsVersion() {
    {
        config := &tls.Config{}
-       config.MinVersion = 0
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MinVersion = tls.VersionSSL30
+       config.MinVersion = tls.VersionTLS12
    }
    {
        config := &tls.Config{}
-       config.MaxVersion = tls.VersionSSL30
    }
    {
-       config := &tls.Config{}
+       config := &tls.Config{MinVersion: tls.VersionTLS12}
    }
}

func insecureCipherSuites() {
    config := &tls.Config{
        CipherSuites: []uint16{
-           tls.TLS_RSA_WITH_RC4_128_SHA,
+           tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        },
+       MinVersion: tls.VersionTLS12,
    }
    _ = config
}

By using safe TLS versions (e.g., tls.VersionTLS12) and secure cipher suites we can
mitigate the risk of insecure TLS configurations and improve the security of the
application.

---

🐸 JFrog Frogbot

[github-actions]

tr

at artifactory_test.go (line 1797)

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
High	Improper Certificate Validation

Full description

Overview

Improper certificate validation is a type of vulnerability that occurs when
an application does not properly validate the authenticity of a certificate
presented by a remote server.

Vulnerable example

package main

import (
    "crypto/tls"
    "net/http"
)

func doReq(req *http.Request) *http.Response {
    tr := &http.Transport{
        TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
    }
    client := &http.Client{Transport: tr}
    res, _ := client.Do(req)
    return res
}

In this example, the InsecureSkipVerify field is set to true, which
disables certificate validation, making the application vulnerable.

Remediation

tr := &http.Transport{
-    TLSClientConfig: &tls.Config{InsecureSkipVerify: true},
+    TLSClientConfig: &tls.Config{InsecureSkipVerify: false},
}

By setting InsecureSkipVerify to false, the application will validate
the authenticity of the certificate presented by the remote server.

Code Flows

Vulnerable data flow analysis result

↘️ { //#nosec G402 jfrog-ignore - false positive TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, } (at artifactory_test.go line 1768)

↘️ tr (at artifactory_test.go line 1768)

↘️ tr (at artifactory_test.go line 1797)

---

🐸 JFrog Frogbot