Skip to content

Commit 8f52089

Browse files
authored
C#: Fix CWE tag for cs/insufficient-key-size
Since this targets CWE-326 Inadequate Encryption Strength > The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. > \- https://cwe.mitre.org/data/definitions/326.html and not CWE-327: Use of a Broken or Risky Cryptographic Algorithm > The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information. > \- https://cwe.mitre.org/data/definitions/327.html This matches what we do for similar query in Python: https://github.com/github/codeql/blob/main/python/ql/src/Security/CWE-326/WeakCryptoKey.ql
1 parent 1dc712f commit 8f52089

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

csharp/ql/src/Security Features/InsufficientKeySize.ql

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
* @precision high
88
* @id cs/insufficient-key-size
99
* @tags security
10-
* external/cwe/cwe-327
10+
* external/cwe/cwe-326
1111
*/
1212

1313
import csharp

0 commit comments

Comments
 (0)