eclipse-paho / eclipse-paho/paho.mqtt.java
Not properly generated randomised for SSLContext
- Dominant language
- Java
- Stars
- 2.3k
- Forks
- 919
- PR merge metrics
- No merged PRs in 30d
Description
Please fill out the form below before submitting, thank you!
- [ ] Bug exists Release Version 1.2.5 ( Master Branch)
- [ ] Bug exists in MQTTv3 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
- [x] Bug exists in MQTTv5 Client on Snapshot Version 1.2.6-SNAPSHOT (Develop Branch)
During an empirical study to understand the nature of cryptographic misuses in enterprise-driven projects on GitHub, we randomly inspected a few of the misuses. One of the misuses for which we could confirm as a true positive of the analysis, [CogniCryptSAST](https://github.com/CROSSINGTUD/CryptoAnalysis), is in this project.
In the class [SSLSocketFactoryFactory](https://github.com/eclipse/paho.mqtt.java/blob/6f35dcb785597a6fd49091efe2dba47513939420/org.eclipse.paho.mqttv5.client/src/main/java/org/eclipse/paho/mqttv5/client/security/SSLSocketFactoryFactory.java) the initialization of the *SSLContext* passes a not properly generated randomized [(*null*)](https://github.com/eclipse/paho.mqtt.java/blob/6f35dcb785597a6fd49091efe2dba47513939420/org.eclipse.paho.mqttv5.client/src/main/java/org/eclipse/paho/mqttv5/client/security/SSLSocketFactoryFactory.java#L1292).
**Expected behavior:** A properly generated randomized is passed
**Observed behavior:** Null is passed
**How to Reproduce:**
- Apply CogniCryptSAST to the project
- Inspect the misuses reported
Contributor guide
Assessment
This issue has not been assessed yet.