mcp-server-semgrep/semgrep-rules/python/cryptography/security/insecure-cipher-algorithms-blowfish.yaml

MCP Server for Semgrep Integration - static code analysis with AI

rules:
- id: insecure-cipher-algorithm-blowfish
  message: >-
    Blowfish is a block cipher developed by Bruce Schneier. It is known to be susceptible to attacks when using weak keys. 
    The author has recommended that users of Blowfish move to newer algorithms such as AES.
    With the `cryptography` package it is recommended to use `Fernet` which is a secure implementation
    of AES in CBC mode with a 128-bit key. 
    Alternatively, keep using the `Cipher` class from the hazmat primitives but use the AES algorithm instead.
  metadata:
    source-rule-url: https://github.com/PyCQA/bandit/blob/d5f8fa0d89d7b11442fc6ec80ca42953974354c8/bandit/blacklists/calls.py#L98
    cwe:
    - 'CWE-327: Use of a Broken or Risky Cryptographic Algorithm'
    owasp:
    - A03:2017 - Sensitive Data Exposure
    - A02:2021 - Cryptographic Failures
    bandit-code: B304
    references:
    - https://cryptography.io/en/latest/hazmat/primitives/symmetric-encryption/#weak-ciphers
    - https://tools.ietf.org/html/rfc5469
    category: security
    technology:
    - cryptography
    subcategory:
    - vuln
    likelihood: MEDIUM
    impact: MEDIUM
    confidence: MEDIUM
    functional-categories:
    - crypto::search::symmetric-algorithm::cryptography
  severity: WARNING
  languages:
  - python
  patterns: 
    - pattern: cryptography.hazmat.primitives.ciphers.algorithms.$BLOWFISH($KEY)
    - metavariable-regex:
        metavariable: $BLOWFISH
        regex: ^(Blowfish)$
    - focus-metavariable: $BLOWFISH
  fix: AES