From 44a1e0644b281529d0a3e4a3464e2b468dd3d956 Mon Sep 17 00:00:00 2001 From: Eddy Ashton Date: Tue, 5 Apr 2022 10:03:04 +0100 Subject: [PATCH] Pin `testssl` to v3.0.7 (#3736) --- CMakeLists.txt | 2 +- tests/tls_report.csv | 202 ++++++++++++++++++++----------------------- tests/tlstest.py | 8 +- 3 files changed, 99 insertions(+), 113 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index eb9524e735..6e5c6a6927 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -668,7 +668,7 @@ if(BUILD_TESTS) OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/testssl/testssl.sh COMMAND rm -rf ${CMAKE_CURRENT_BINARY_DIR}/testssl && git clone --depth 1 - https://github.com/drwetter/testssl.sh + --branch v3.0.7 --single-branch https://github.com/drwetter/testssl.sh ${CMAKE_CURRENT_BINARY_DIR}/testssl ) add_custom_target( diff --git a/tests/tls_report.csv b/tests/tls_report.csv index 4ccb3cc4c8..cd50d2f4de 100644 --- a/tests/tls_report.csv +++ b/tests/tls_report.csv @@ -1,104 +1,85 @@ -"id","fqdn/ip","port","severity","finding","cve","cwe" -"service","","INFO","HTTP","","" -"pre_128cipher","","INFO","No 128 cipher limit bug","","" +"ALPN","","INFO","http/1.1","","" +"BEAST","","OK","not vulnerable, no SSL3 or TLS1","CVE-2011-3389","CWE-20" +"BREACH","","OK","not vulnerable, no HTTP compression - only supplied '/' tested","CVE-2013-3587","CWE-310" +"CCS","","OK","not vulnerable","CVE-2014-0224","CWE-310" +"CRIME_TLS","","OK","not vulnerable","CVE-2012-4929","CWE-310" +"DNS_CAArecord","","LOW","--","","" +"DROWN","","OK","not vulnerable on this host and port","CVE-2016-0800 CVE-2016-0703","CWE-310" +"DROWN_hint","","INFO","no RSA certificate, can't be used with SSLv2 elsewhere","CVE-2016-0800 CVE-2016-0703","CWE-310" +"FREAK","","OK","not vulnerable","CVE-2015-0204","CWE-310" +"HPKP","","INFO","No support for HTTP Public Key Pinning","","" +"HSTS","","LOW","not offered","","" +"HTTP_clock_skew","","INFO","Got no HTTP time, maybe try different URL?","","" +"HTTP_status_code","","INFO","404 Not Found ('/')","","" +"LOGJAM","","OK","not vulnerable, no DH EXPORT ciphers,","CVE-2015-4000","CWE-310" +"LOGJAM-common_primes","","OK","no DH key with <= TLS 1.2","CVE-2015-4000","CWE-310" +"LUCKY13","","OK","not vulnerable","CVE-2013-0169","CWE-310" +"NPN","","INFO","not offered","","" +"OCSP_stapling","","INFO","not offered","","" +"PFS","","OK","offered","","" +"PFS_ECDHE_curves","","OK","secp384r1 secp521r1","","" +"PFS_ciphers","","INFO","TLS_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256","","" +"POODLE_SSL","","OK","not vulnerable, no SSLv3","CVE-2014-3566","CWE-310" +"RC4","","OK","not vulnerable","CVE-2013-2566 CVE-2015-2808","CWE-310" +"ROBOT","","OK","not vulnerable, no RSA key transport cipher","CVE-2017-17382 CVE-2017-17427 CVE-2017-17428 CVE-2017-13098 CVE-2017-1000385 CVE-2017-13099 CVE-2016-6883 CVE-2012-5081 CVE-2017-6168","CWE-203" +"SSL_sessionID_support","","INFO","yes","","" "SSLv2","","OK","not offered","","" "SSLv3","","OK","not offered","","" +"SWEET32","","OK","not vulnerable","CVE-2016-2183 CVE-2016-6329","CWE-327" "TLS1","","INFO","not offered","","" "TLS1_1","","INFO","not offered","","" "TLS1_2","","OK","offered","","" "TLS1_3","","OK","offered with final","","" -"NPN","","INFO","not offered","","" -"ALPN","","INFO","http/1.1","","" -"cipherlist_NULL","","OK","not offered","","CWE-327" -"cipherlist_aNULL","","OK","not offered","","CWE-327" -"cipherlist_EXPORT","","OK","not offered","","CWE-327" -"cipherlist_LOW","","OK","not offered","","CWE-327" -"cipherlist_3DES_IDEA","","INFO","not offered","","CWE-310" -"cipherlist_AVERAGE","","INFO","not offered","","CWE-310" -"cipherlist_GOOD","","INFO","not offered","","" -"cipherlist_STRONG","","OK","offered","","" -"cipher_order","","OK","server","","" -"protocol_negotiated","","OK","Default protocol TLS1.3","","" -"cipher_negotiated","","OK","TLS_AES_256_GCM_SHA384, 521 bit ECDH (P-521)","","" -"cipher-tls1_2_xc02c","","OK","TLSv1.2 xc02c ECDHE-ECDSA-AES256-GCM-SHA384 ECDH 521 AESGCM 256 TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","","" -"cipher-tls1_2_xc02b","","OK","TLSv1.2 xc02b ECDHE-ECDSA-AES128-GCM-SHA256 ECDH 521 AESGCM 128 TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","","" -"cipherorder_TLSv1_2","","INFO","ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-ECDSA-AES128-GCM-SHA256","","" -"cipher-tls1_3_x1302","","OK","TLSv1.3 x1302 TLS_AES_256_GCM_SHA384 ECDH 521 AESGCM 256 TLS_AES_256_GCM_SHA384","","" -"cipher-tls1_3_x1301","","OK","TLSv1.3 x1301 TLS_AES_128_GCM_SHA256 ECDH 521 AESGCM 128 TLS_AES_128_GCM_SHA256","","" -"cipherorder_TLSv1_3","","INFO","TLS_AES_256_GCM_SHA384 TLS_AES_128_GCM_SHA256","","" -"FS","","OK","offered","","" -"FS_ciphers","","INFO","TLS_AES_256_GCM_SHA384 ECDHE-ECDSA-AES256-GCM-SHA384 TLS_AES_128_GCM_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256","","" -"FS_ECDHE_curves","","OK","secp384r1 secp521r1","","" "TLS_extensions","","INFO","'renegotiation info/#65281' 'EC point formats/#11' 'session ticket/#35' 'supported versions/#43' 'key share/#51' 'supported_groups/#10' 'max fragment length/#1' 'application layer protocol negotiation/#16' 'extended master secret/#23'","","" "TLS_session_ticket","","INFO","valid for 7200 seconds only (