[Security Bug] Insecure crypto usage

[nageshservicenow]

Description

Detected SSL that will accept an unverified connection. This makes the connections susceptible to man-in-the-middle attacks.

Used verify_mode as VERIFY_NONE as below in various source code file in this repo.
..
http.verify_mode = OpenSSL::SSL::VERIFY_NONE
..

Effected files:
metrics-apache-graphite.rb :

sensu-plugins-http/bin/check-http-json.rb

Line 164 in 115bc8d

http.verify_mode = OpenSSL::SSL::VERIFY_NONE if config[:insecure]

sensu-plugins-http/bin/check-http.rb

Line 330 in 115bc8d

http.verify_mode = OpenSSL::SSL::VERIFY_NONE if config[:insecure]

sensu-plugins-http/bin/check-https-cert.rb

Line 90 in 115bc8d

OpenSSL::SSL::VERIFY_NONE

sensu-plugins-http/bin/metrics-http-json-deep.rb

Line 112 in 115bc8d

http.verify_mode = OpenSSL::SSL::VERIFY_NONE

Remediation

1. Use 'OpenSSL::SSL::VERIFY_PEER' instead.