rules:
- id: ssl-wrap-socket-is-deprecated
  pattern: ssl.wrap_socket(...)
  message: >-
    'ssl.wrap_socket()' is deprecated. This function creates an insecure socket
    without server name indication or hostname matching. Instead, create an SSL
    context using 'ssl.SSLContext()' and use that to wrap a socket.
  metadata:
    cwe:
    - 'CWE-326: Inadequate Encryption Strength'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    - A04:2025 - Cryptographic Failures
    references:
    - https://docs.python.org/3/library/ssl.html#ssl.wrap_socket
    - https://docs.python.org/3/library/ssl.html#ssl.SSLContext.wrap_socket
    category: security
    technology:
    - python
    subcategory:
    - vuln
    likelihood: LOW
    impact: MEDIUM
    confidence: MEDIUM
  languages: [python]
  severity: WARNING