Background
Legacy ssl_options["ssl_version"] accepts explicit TLS 1.0 and TLS 1.1 protocol constants for both stdlib SSL and pyOpenSSL paths. This behavior predates PR #938 and currently exists on master in cassandra/connection.py.
PR #938 moves the shared TLS context construction into cassandra/tls.py, causing CodeQL alert #28 (py/insecure-protocol) to report the pre-existing compatibility behavior as new code in the pull request.
Proposed change
- Deprecate explicit TLS 1.0 and TLS 1.1 protocol selection.
- Warn when callers select
ssl.PROTOCOL_TLSv1, ssl.PROTOCOL_TLSv1_1, or corresponding symbolic/pyOpenSSL values.
- In the next major release, reject those values and require TLS 1.2 or newer.
- Apply the policy consistently to stdlib, Eventlet, and Twisted TLS paths.
- Update security documentation, changelog entries, and tests.
Compatibility
This is intentionally separate from #938 because rejecting legacy protocol values is a compatibility-breaking change. The current secure default remains unchanged; old protocol versions require legacy caller configuration.
Background
Legacy
ssl_options["ssl_version"]accepts explicit TLS 1.0 and TLS 1.1 protocol constants for both stdlib SSL and pyOpenSSL paths. This behavior predates PR #938 and currently exists onmasterincassandra/connection.py.PR #938 moves the shared TLS context construction into
cassandra/tls.py, causing CodeQL alert #28 (py/insecure-protocol) to report the pre-existing compatibility behavior as new code in the pull request.Proposed change
ssl.PROTOCOL_TLSv1,ssl.PROTOCOL_TLSv1_1, or corresponding symbolic/pyOpenSSL values.Compatibility
This is intentionally separate from #938 because rejecting legacy protocol values is a compatibility-breaking change. The current secure default remains unchanged; old protocol versions require legacy caller configuration.