You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Insecure TLS Version rule for Azure providers is incorrectly reporting Insecure TLS version. The check only does a strict equality check for 1.2, and it reports TLS 1.3 workloads as being non-compliant with the rule.
I think here you'd want to add 1.3 as a valid value too.
To Reproduce
Run ScoutSuite on any Azure environment with an app service which has TLS 1.3 configured as minimum TLS version, but I ran the check with these parameters on our own tenant which has such service configured.
Describe the bug
Insecure TLS Version rule for Azure providers is incorrectly reporting Insecure TLS version. The check only does a strict equality check for 1.2, and it reports TLS 1.3 workloads as being non-compliant with the rule.
I think here you'd want to add 1.3 as a valid value too.
To Reproduce
Run ScoutSuite on any Azure environment with an app service which has TLS 1.3 configured as minimum TLS version, but I ran the check with these parameters on our own tenant which has such service configured.
Additional context
It is not necessarily a bug, just a false positive report, which can be easily avoided. I can create PR for this later, since it's easy fix.
The text was updated successfully, but these errors were encountered: