# V5313. OWASP. Do not use old versions of SSL/TLS protocols as it may cause security issues.

The analyzer has detected that the application uses legacy versions of the SSL/TLS protocol. This can expose the application to attacks such as man-in-the-middle, BEAST, etc.

Issues related to the use of outdated protocols can fall into two OWASP Top 10 2021 categories:

- A2: Cryptographic Failures
- A7: Identification and Authentication Failures

Look at the following example:

    private void createSocket() {
        SSLContext sslContext;
        try {
            sslContext = SSLContext.getInstance("TLSv1");    // <=
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }

        try {
            sslContext.init(null, null, new SecureRandom());
            var socketFactory = sslContext.getSocketFactory();
            var socket = (SSLSocket) socketFactory.createSocket();

            // ....

            socket.close();
        } catch (KeyManagementException | IOException e) {
            throw new RuntimeException(e);
        }
    }

The code above contains the `TLSv1` value that represents the 1.0 version of the TLS protocol. This version is outdated and not recommended because TLS 1.0 is vulnerable to a number of attacks, including the aforementioned BEAST.

Experts recommend using newer protocol versions, such as TLS 1.2:

    private void createSocket() {
        SSLContext sslContext;
        try {
            sslContext = SSLContext.getInstance("TLSv1.2");
        } catch (NoSuchAlgorithmException e) {
            throw new RuntimeException(e);
        }

        try {
            sslContext.init(null, null, new SecureRandom());
            var socketFactory = sslContext.getSocketFactory();
            var socket = (SSLSocket) socketFactory.createSocket();

            // ....

            socket.close();
        } catch (KeyManagementException | IOException e) {
            throw new RuntimeException(e);
        }
    }

Protocol versions below TLS 1.2 are not recommended as they may cause security issues. These protocols include SSL 2.0 and 3.0, as well as TLS 1.0 and 1.1.

Usually, `TLS` is the most appropriate value, which allows the platform to choose the data transfer protocol. If for some reason the value does not fit, set the latest version available.

## Additional links:

- Transport Layer Security (TLS) Protocol Overview
- Testing for Weak SSL TLS Ciphers Insufficient Transport Layer Protection
- Transport Layer Security Cheat Sheet
- Man-in-the-middle attack description
- Man-in-the-Browser attack description

This diagnostic is classified as:

CWE-327 OWASP-9.1.3 CERT-MSC61-J