rules:
- id: net-telnet-request
  message: >-
    Checks for creation of telnet servers or attempts to connect through telnet. This is insecure as the
    telnet protocol
    supports
    no encryption, and data passes through unencrypted.
  severity: WARNING
  metadata:
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    category: security
    cwe: 'CWE-319: Cleartext Transmission of Sensitive Information'
    owasp: 'A03:2017 - Sensitive Data Exposure'
    references:
    - https://docs.ruby-lang.org/en/2.2.0/Net/Telnet.html
    - https://www.rubydoc.info/gems/net-ssh-telnet2/0.1.0/Net/SSH/Telnet
    subcategory:
    - vuln
    technology:
    - ruby
    vulnerability: Insecure Transport
  languages:
  - ruby
  pattern-either:
  - pattern: |
      Net::Telnet::new(...)
  - pattern: |
      Net::SSH::Telnet.new(...)