rules:
- id: missing-ssl-minversion
  message: >-
    `MinVersion` is missing from this TLS configuration. 
    By default, TLS 1.2 is currently used as the minimum when acting as a client, and TLS 1.0 when acting as a server.
    General purpose web applications should default to TLS 1.3 with all other protocols disabled. 
    Only where it is known that a web server must support legacy clients
    with unsupported an insecure browsers (such as Internet Explorer 10), it may be necessary to enable TLS 1.0 to provide support.
    Add `MinVersion: tls.VersionTLS13' to the TLS configuration to bump the minimum version to TLS 1.3.
  metadata:
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://golang.org/pkg/crypto/tls/#:~:text=MinVersion
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    category: security
    technology:
    - go
    confidence: HIGH
    subcategory:
    - audit
    likelihood: MEDIUM
    impact: LOW
  languages: [go]
  severity: WARNING
  patterns:
  - pattern: |
      tls.Config{ $...CONF }
  - pattern-not: |
      tls.Config{..., MinVersion: ..., ...}
  fix: |
    tls.Config{ $...CONF, MinVersion: tls.VersionTLS13 }