Description

Detects Azure PostgreSQL Flexible Servers configured with insecure TLS protocol versions (below TLS 1.2). Using outdated TLS versions can expose database communications to known security vulnerabilities and man-in-the-middle attacks.

Detection Strategy

• Retrieves the 'ssl_min_protocol_version' configuration from each PostgreSQL Flexible Server

• Checks if the configured minimum TLS version is less than 1.2

• Reports a vulnerability if an insecure TLS version (TLS 1.0 or TLS 1.1) is allowed