search

ajcrowe / puppet-supervisord

Puppet Module to install and configure applications under supervisord
MIT License
37 stars 104 forks source link

Use of HTTP without TLS #123

Closed akondasif closed 6 years ago

akondasif commented 6 years ago

Greetings,

I am a security researcher, who is looking for security smells in Puppet scripts. I found instances where the HTTP protocol is used instead of HTTPS (HTTP with TLS). According to the Common Weakness Enumeration organization this is a security weakness (https://cwe.mitre.org/data/definitions/319.html). I was wondering why HTTP is used? Is it because of lack of tool support?

I am trying to find out if developers are forced to adopt bad practices due to lack of tool support when it comes to the HTTPS protocol. Maybe it is due to dependency on a resource that uses HTTP?

Any feedback is appreciated.

Source: https://github.com/ajcrowe/puppet-supervisord/blob/master/manifests/init.pp (Line 138)

ajcrowe commented 6 years ago

This is a localhost based resource request closing as invalid