rules:
- id: missing-ssl-minversion
  message: >-
    `MinVersion` is missing from this TLS configuration. The default
    value is TLS1.0 which is considered insecure. Explicitly set the
    `MinVersion` to a secure version of TLS, such as `VersionTLS13`.
  metadata:
    cwe: 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp: 'A9: Using Components with Known Vulnerabilities'
    source-rule-url: https://github.com/securego/gosec/blob/master/rules/tls_config.go
    references:
    - https://golang.org/doc/go1.14#crypto/tls
    - https://golang.org/pkg/crypto/tls/#:~:text=MinVersion
    - https://www.us-cert.gov/ncas/alerts/TA14-290A
    category: security
    technology:
    - go
  languages: [go]
  severity: ERROR
  patterns:
  - pattern: |-
      tls.Config{...}
  - pattern-not-inside: |-
      tls.Config{..., MinVersion: ..., ...}
  fix-regex:
    regex: Config\s*\{
    replacement: 'Config{MinVersion: SSL.VersionTLS13,'