Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Changes for app scan tool vulnerabilities fixes #244

Closed
wants to merge 4 commits into from

Conversation

Ravi-Prabhakar
Copy link
Contributor

Fix for the Git id :
#241

Fix Covers below vulnerabilities:

  1. Missing Cryptographic Step : https://cwe.mitre.org/data/definitions/325.html
  2. Insecure Cryptographic Algorithm : https://cwe.mitre.org/data/definitions/327.html

@CLAassistant
Copy link

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
You have signed the CLA already but the status is still pending? Let us recheck it.

@jouniaro
Copy link
Contributor

Thanks, but I am sorry, we cannot accept the changes. You don't seem to understand the issue. The code is implementing an international standard. You are not free to choose the used algorithms, since these are defined in the standard. The fact that they are not recommended is reflected to the security policies that use these algorithm being deprecated in the standard. But, we cannot remove or change the implementation, since interoperability with systems that still use them requires them.

@Ravi-Prabhakar Ravi-Prabhakar changed the title Changes for MEND SAST vulnerabilities fixes Changes for app scan tool vulnerabilities fixes Jan 23, 2025
@pradeipk
Copy link
Contributor

Thanks @jouniaro for your input. I believe we should mark these issues as exceptions in our scan directory for now, as they align with the OPC UA standard. Additionally, making unilateral changes could potentially affect communication with the endpoint.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants