Description

This detector identifies the use of deprecated PEM block encryption functions in Go's crypto/x509 package. These functions (EncryptPEMBlock, DecryptPEMBlock, IsEncryptedPEMBlock) use weak encryption algorithms and have been deprecated due to security vulnerabilities, potentially exposing sensitive data to cryptographic attacks.

Detection Strategy

• The detector triggers when Go code imports the 'crypto/x509' package

• It identifies calls to any of the three deprecated PEM block encryption functions: EncryptPEMBlock, DecryptPEMBlock, or IsEncryptedPEMBlock

• The detector handles cases where the x509 package is imported with an alias and matches function calls using the appropriate alias

• A vulnerability is reported for each occurrence of these deprecated function calls in the codebase

Vulnerable code example

package main

import (
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"
	"encoding/pem"
)...

✅ Secure code example

package main

import (
	"crypto/aes"
	"crypto/cipher"
	"crypto/rand"
	"crypto/rsa"
	"crypto/x509"...