From a403a65fb5421ea795a608979d0052e5d197f166 Mon Sep 17 00:00:00 2001
From: AkhtarAmir <AkhtarAmir>
Date: Fri, 8 Nov 2024 20:06:46 +0500
Subject: [PATCH] TLS Version change

---
 .DS_Store                                        | Bin 0 -> 8196 bytes
 .../azure/eventhub/eventHubMinimumTLSversion.js  |  10 +---------
 plugins/azure/redisCache/minimumTlsVersion.js    |   4 ++--
 plugins/azure/sqlserver/sqlServerTlsVersion.js   |  10 +---------
 .../storageaccounts/storageAccountsTlsVersion.js |  12 ++----------
 5 files changed, 6 insertions(+), 30 deletions(-)
 create mode 100644 .DS_Store

diff --git a/.DS_Store b/.DS_Store
new file mode 100644
index 0000000000000000000000000000000000000000..6dee872861bd116d3a08409a45588a1811cd649f
GIT binary patch
literal 8196
zcmeI1&2G~`5XWcRK%9hrAc0g4NS3%(rKJ=JaY@tmPzg9R2o8WkK1>?wuA|r?MO9JG
z@D98JSDu7-;ROGgbt|uv_Rs?YbyxC^W6ytg_BZQw*CirV8+O)+mWas1!FI8NYD(ez
zd`y&?^vWGr1wGLL1vH=@bxBWny9<thBj5-)0*-(q@GlU+JDZDl&U@e7b+sel2wX`5
zygv9i*j7_JHddAnRI&wtE#R^goMRs#8b7tw)Q*i6DcUr<2bD@yy2VgNj{82l!&Xx}
zHrB{V89Ax6XO-?yl=KdrFYctO#=6=Oa0Dg^@ZNonR;WV}wXOYogq?h_8%FI`7`5Pq
z2WzH_2W$Sf6lrQ6%79`DvFF#6K+(pP54aMMwzaeg?dOcP0M9OTNzU*4d48=?+)rcq
z(dvi2I9Xl&sb*#i*RB`6qF3?W*7u`PJ!vMxxYiuJ=3g(OC~TdcH(M`z!Kkr#Yb(-8
zv!{cB2zs3WE^l7-bSE0sqM`1@qOF@7Udbyp7MG5X*VZ2_`x_hUC(Hiv;|HtD{=@Z0
zCnqKE_PzU0_8JG_p^m;7z$#s&K-Ml_@w0e3ZrZ0Iwd~QWySdSq&%Di7l_^<KXw@Ri
z8clsVOuxiT)BMV5D$sELn)DH>7{5M2AKKAL{<AqOBi|9SA7U1?q351rTf=#$l}z4m
zibm6WiLL?V5qdpDyxfY+o?Hu<5mpOj+Rn^YZU;(R!yGM5A)Vp5=$M`5S3(S0=B1t<
zjRHAKF`rY!7zxvuG7{!zY0L0Df<JRhggTxbdnCf|TZZ4lgyw=CiP>e<Ma;SYyg0^*
zTnV+Tw+FTw<T%PH;}LpU{~|r5UD~1@dQNrPu}320vfgtTcOvl&sDT*}p{JqDf*b?k
zmQ~(B{7o=EK;1=j7p*zj^{NP6h(37T(G#S3<;i+iBr`E$?1L4rkG$69Vv{E}t18hR
z#=nU<`V4jj<Lcx%@bj8gETHv3V#2B^v*3b^GDS;`1iRu0T!O%?(JWP9ch3L*e~Ffz
z#1U`={uctOuwCD-A==YFTl0bQUfaj<4hI+Z8yhPURI(k1mF+m}**^?%?!%Qe)zprS
T#TAsl{vp7<|Ao7&t~P-`F8R&o

literal 0
HcmV?d00001

diff --git a/plugins/azure/eventhub/eventHubMinimumTLSversion.js b/plugins/azure/eventhub/eventHubMinimumTLSversion.js
index dbba63485e..a870e802b5 100644
--- a/plugins/azure/eventhub/eventHubMinimumTLSversion.js
+++ b/plugins/azure/eventhub/eventHubMinimumTLSversion.js
@@ -11,14 +11,6 @@ module.exports = {
     recommended_action: 'Modify Event Hubs namespaces to set the desired minimum TLS version.',
     link: 'https://learn.microsoft.com/en-us/azure/event-hubs/transport-layer-security-enforce-minimum-version',
     apis: ['eventHub:listEventHub'],
-    settings: {
-        event_hub_min_tls_version: {
-            name: 'Event Hub Minimum TLS Version',
-            description: 'Minimum desired TLS version for Microsoft Azure Event Hubs',
-            regex: '^(1.0|1.1|1.2)$',
-            default: '1.2'
-        }
-    },
     realtime_triggers: ['microsofteventhub:namespaces:write', 'microsofteventhub:namespaces:delete'],
 
     run: function(cache, settings, callback) {
@@ -27,7 +19,7 @@ module.exports = {
         var locations = helpers.locations(settings.govcloud);
 
         var config = {
-            event_hub_min_tls_version: settings.event_hub_min_tls_version || this.settings.event_hub_min_tls_version.default
+            event_hub_min_tls_version: '1.2'
         };
 
         var desiredVersion = parseFloat(config.event_hub_min_tls_version);
diff --git a/plugins/azure/redisCache/minimumTlsVersion.js b/plugins/azure/redisCache/minimumTlsVersion.js
index d02f37f187..c214a69eec 100644
--- a/plugins/azure/redisCache/minimumTlsVersion.js
+++ b/plugins/azure/redisCache/minimumTlsVersion.js
@@ -7,7 +7,7 @@ module.exports = {
     domain: 'Databases',
     severity: 'Medium',
     description: 'Ensures that Azure Cache for Redis is using the latest TLS version.',
-    more_info: 'TLS versions 1.0 and 1.1 are known to be susceptible to attacks, and to have other Common Vulnerabilities and Exposures (CVE) weaknesses.So there\'s an industry- wide push toward the exclusive use of Transport Layer Security(TLS) version 1.2 or later.',
+    more_info: 'TLS versions 1.2 is known to be susceptible to attacks, and to have other Common Vulnerabilities and Exposures (CVE) weaknesses.So there\'s an industry- wide push toward the exclusive use of Transport Layer Security(TLS) version 1.2 or later.',
     recommended_action: 'Ensure that Azure cache for Redis is using the latest TLS version',
     link: 'https://learn.microsoft.com/en-us/azure/azure-cache-for-redis/cache-remove-tls-10-11',
     apis: ['redisCaches:listBySubscription'],
@@ -37,7 +37,7 @@ module.exports = {
             for (let cache of caches.data) {
                 if (!cache.minimumTlsVersion) {
                     helpers.addResult(results, 2, 'Redis Cache is using the default TLS Version', location, cache.id);
-                } else if (cache.minimumTlsVersion && (cache.minimumTlsVersion === '1.0' || cache.minimumTlsVersion === '1.1')) {
+                } else if (cache.minimumTlsVersion && (cache.minimumTlsVersion === '1.2')) {
                     helpers.addResult(results, 2, 'Redis Cache is not using the latest TLS Version', location, cache.id);
                 } else {
                     helpers.addResult(results, 0, 'Redis Cache is using the latest TLS Version', location, cache.id);
diff --git a/plugins/azure/sqlserver/sqlServerTlsVersion.js b/plugins/azure/sqlserver/sqlServerTlsVersion.js
index 1b51bd8220..d40df27faa 100644
--- a/plugins/azure/sqlserver/sqlServerTlsVersion.js
+++ b/plugins/azure/sqlserver/sqlServerTlsVersion.js
@@ -11,14 +11,6 @@ module.exports = {
     recommended_action: 'Modify SQL server firewall and virtual network settings to set desired minimum TLS version.',
     link: 'https://learn.microsoft.com/en-us/azure/azure-sql/database/connectivity-settings#minimal-tls-version',
     apis: ['servers:listSql'],
-    settings: {
-        sql_server_min_tls_version: {
-            name: 'SQL Server Minimum TLS Version',
-            description: 'Minimum desired TLS version for Microsoft Azure SQL servers',
-            regex: '^(1.0|1.1|1.2)$',
-            default: '1.2'
-        }
-    },
     remediation_min_version: '202104012200',
     remediation_description: 'TLS version 1.2 will be set for the affected SQL server',
     apis_remediate: ['servers:listSql'],
@@ -32,7 +24,7 @@ module.exports = {
         var locations = helpers.locations(settings.govcloud);
 
         var config = {
-            sql_server_min_tls_version: settings.sql_server_min_tls_version || this.settings.sql_server_min_tls_version.default
+            sql_server_min_tls_version: '1.2'
         };
 
         var desiredVersion = parseFloat(config.sql_server_min_tls_version);
diff --git a/plugins/azure/storageaccounts/storageAccountsTlsVersion.js b/plugins/azure/storageaccounts/storageAccountsTlsVersion.js
index a0fac3088c..5b4501cf01 100644
--- a/plugins/azure/storageaccounts/storageAccountsTlsVersion.js
+++ b/plugins/azure/storageaccounts/storageAccountsTlsVersion.js
@@ -12,14 +12,6 @@ module.exports = {
     recommended_action: 'Modify Storage Account configuration and set desired minimum TLS version',
     link: 'https://learn.microsoft.com/en-us/azure/storage/common/transport-layer-security-configure-minimum-version',
     apis: ['storageAccounts:list'],
-    settings: {
-        sa_min_tls_version: {
-            name: 'Storage Account Minimum TLS Version',
-            description: 'Minimum desired TLS version for Microsoft Azure Storage Accounts',
-            regex: '^(1.0|1.1|1.2)$',
-            default: '1.2'
-        }
-    },
     remediation_min_version: '202112312200',
     remediation_description: 'TLS version 1.2 will be set for the affected Storage Accounts',
     apis_remediate: ['storageAccounts:list'],
@@ -33,7 +25,7 @@ module.exports = {
         var locations = helpers.locations(settings.govcloud);
 
         var config = {
-            sa_min_tls_version: settings.sa_min_tls_version || this.settings.sa_min_tls_version.default
+            sa_min_tls_version: 1.2
         };
 
         var desiredVersion = parseFloat(config.sa_min_tls_version);
@@ -58,7 +50,7 @@ module.exports = {
             storageAccounts.data.forEach(function(storageAccount) {
                 if (!storageAccount.id) return;
 
-                let tlsVersion = storageAccount.minimumTlsVersion ? storageAccount.minimumTlsVersion : 'TLS1.0'; //Default is TLS 1.0
+                let tlsVersion = storageAccount.minimumTlsVersion ? storageAccount.minimumTlsVersion : 'TLS1.2'; //Default is TLS 1.2
                 tlsVersion = tlsVersion.replace('TLS', '');
                 tlsVersion = tlsVersion.replace('_', '.');