Inadequate encryption strength
ID |
scala.cryptography.scala_crypto_rule_defaulthttpclient |
Severity |
low |
Remediation Complexity |
medium |
Remediation Risk |
medium |
Remediation Effort |
medium |
Resource |
Cryptography |
Language |
Scala |
Rationale
DefaultHttpClient with default constructor is not compatible with TLS 1.2
The following code illustrates a vulnerable pattern detected by this rule:
class CatalogueFetcher {
@throws[IOException]
def fetch(): Unit = {
// VULNERABLE: Inadequate encryption strength
val client = new DefaultHttpClient
val request = new HttpGet("https://catalogue.internal/items")
client.execute(request)
}
}Remediation
Follow secure coding practices and review the references below for detailed remediation guidance.
References
-
OWASP Top 10 2025 - A04 : Cryptographic Failures.