Communication with an insecure SMTP connection detected.

• Rule ID: php_symfony_insecure_smtp
• Languages: php
• Source: insecure_smtp.yml

Description

Secure connections using SMTP help prevent unauthorized actors from viewing transmitted data. This policy checks if SMTP mailer settings are set to only allow secure connections.

Remediations

✅ When using the SMTP protocol, make sure to enable SSL encryption in ActionMailer configuration:

config.action_mailer.smtp_settings = {
	...
	ssl: true
}

Resources

• OWASP insecure transport

Associated CWE

• CWE-319: Cleartext Transmission of Sensitive Information

OWASP Top 10

• A02:2021 - Cryptographic Failures

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=php_symfony_insecure_smtp

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=php_symfony_insecure_smtp