Rule Definition
Secure Socket Layer (SSL) technology is security that is implemented at the transport layer (see Transport-Layer Security for more information about transport-layer security). SSL allows web browsers and web servers to communicate over a secure connection. In this secure connection, the data is encrypted before being sent and then is decrypted upon receipt and before processing. Both the browser and the server encrypt all traffic before sending any data. SSL addresses the following important security considerations: Authentication, Confidentiality and Integrity
Remediation
Do not use DefaultHttpClient
Violation Code Sample
HttpClient client = new DefaultHttpClient(); // Violation
Fixed Code Sample
HttpClient client = HttpClientBuilder.create().useSystemProperties().build(); // Violation FIXED
Reference
https://blogs.oracle.com/java-platform-group/entry/diagnosing_tls_ssl_and_https
Related Technologies
Technical Criterion
CWE-319 - Cleartext Transmission of Sensitive Information
About CAST Appmarq
CAST Appmarq is by far the biggest repository of data about real IT systems. It's built on thousands of analyzed applications, made of 35 different technologies, by over 300 business organizations across major verticals. It provides IT Leaders with factual key analytics to let them know if their applications are on track.