diff --git a/components/package.json b/components/package.json index 6ff5bff877e..e037cef0533 100644 --- a/components/package.json +++ b/components/package.json @@ -1,6 +1,6 @@ { "name": "defectdojo", - "version": "2.41.3", + "version": "2.41.4", "license" : "BSD-3-Clause", "private": true, "dependencies": { diff --git a/docs/content/en/connecting_your_tools/parsers/generic_findings_import.md b/docs/content/en/connecting_your_tools/parsers/generic_findings_import.md index fa65af9d2d5..a4395118e0e 100644 --- a/docs/content/en/connecting_your_tools/parsers/generic_findings_import.md +++ b/docs/content/en/connecting_your_tools/parsers/generic_findings_import.md @@ -11,6 +11,8 @@ These attributes are supported for CSV: - Date: Date of the finding in mm/dd/yyyy format. - Title: Title of the finding - CweId: Cwe identifier, must be an integer value. +- epss_score: The probability of exploitation in the next 30 days, must be a float value between 0 and 1.0. +- epss_percentile: The proportion of all scored vulnerabilities with the same or a lower EPSS score, must be a float value between 0 and 1.0. - Url: Url associated with the finding. - Severity: Severity of the finding. Must be one of Info, Low, Medium, High, or Critical. - Description: Description of the finding. Can be multiple lines if enclosed in double quotes. diff --git a/dojo/__init__.py b/dojo/__init__.py index d6ab484dc20..5b3feec85aa 100644 --- a/dojo/__init__.py +++ b/dojo/__init__.py @@ -4,6 +4,6 @@ # Django starts so that shared_task will use this app. from .celery import app as celery_app # noqa: F401 -__version__ = "2.41.3" +__version__ = "2.41.4" __url__ = "https://github.com/DefectDojo/django-DefectDojo" __docs__ = "https://documentation.defectdojo.com" diff --git a/dojo/api_v2/serializers.py b/dojo/api_v2/serializers.py index 5cdc2db4d88..9ee4ce457a6 100644 --- a/dojo/api_v2/serializers.py +++ b/dojo/api_v2/serializers.py @@ -2087,10 +2087,10 @@ class CommonImportScanSerializer(serializers.Serializer): help_text="Minimum severity level to be imported", ) active = serializers.BooleanField( - help_text="Override the active setting from the tool.", + help_text="Force findings to be active/inactive or default to the original tool (None)", required=False, ) verified = serializers.BooleanField( - help_text="Override the verified setting from the tool.", + help_text="Force findings to be verified/not verified or default to the original tool (None)", required=False, ) # TODO: why do we allow only existing endpoints? diff --git a/dojo/settings/settings.dist.py b/dojo/settings/settings.dist.py index 6022f1704cd..06ec60e9202 100644 --- a/dojo/settings/settings.dist.py +++ b/dojo/settings/settings.dist.py @@ -1776,6 +1776,7 @@ def saml2_attrib_map_format(dict): "CWE": "https://cwe.mitre.org/data/definitions/&&.html", # e.g. https://cwe.mitre.org/data/definitions/79.html "RLSA": "https://errata.rockylinux.org/", # e.g. https://errata.rockylinux.org/RLSA-2024:7001 "RLBA": "https://errata.rockylinux.org/", # e.g. https://errata.rockylinux.org/RLBA-2024:6968 + "CGA": "https://images.chainguard.dev/security/", # e.g. https://images.chainguard.dev/security/CGA-24pq-h5fw-43v3 } # List of acceptable file types that can be uploaded to a given object via arbitrary file upload FILE_UPLOAD_TYPES = env("DD_FILE_UPLOAD_TYPES") diff --git a/dojo/tools/generic/csv_parser.py b/dojo/tools/generic/csv_parser.py index 4e8acb461d9..9c11133ff59 100644 --- a/dojo/tools/generic/csv_parser.py +++ b/dojo/tools/generic/csv_parser.py @@ -66,6 +66,12 @@ def _get_findings_csv(self, filename): if "CweId" in row: finding.cwe = int(row["CweId"]) + if "epss_score" in row: + finding.epss_score = float(row["epss_score"]) + + if "epss_percentile" in row: + finding.epss_percentile = float(row["epss_percentile"]) + if "CVSSV3" in row: cvss_objects = cvss_parser.parse_cvss_from_text(row["CVSSV3"]) if len(cvss_objects) > 0: diff --git a/helm/defectdojo/Chart.yaml b/helm/defectdojo/Chart.yaml index 4d63b24192b..d6c561dc9a9 100644 --- a/helm/defectdojo/Chart.yaml +++ b/helm/defectdojo/Chart.yaml @@ -1,8 +1,8 @@ apiVersion: v2 -appVersion: "2.41.3" +appVersion: "2.41.4" description: A Helm chart for Kubernetes to install DefectDojo name: defectdojo -version: 1.6.165 +version: 1.6.166 icon: https://www.defectdojo.org/img/favicon.ico maintainers: - name: madchap diff --git a/unittests/scans/generic/generic_csv_with_epss.csv b/unittests/scans/generic/generic_csv_with_epss.csv new file mode 100644 index 00000000000..f3be723380c --- /dev/null +++ b/unittests/scans/generic/generic_csv_with_epss.csv @@ -0,0 +1,2 @@ +Date,Title,CweId,epss_score,epss_percentile, Url,Severity,Description,Mitigation,Impact,References,Active,Verified,FalsePositive,Duplicate +01/30/2018,"Server leaks inodes via ETags, header found with file /, fields: 0xW/109b 0xpqG8TolgxCnpM/7cGOOI0GRS+rc ",0,.00042,.23474,https://192.168.1.1/,Low,"Server leaks inodes via ETags, header found with file /, fields: 0xW/109b 0xpqG8TolgxCnpM/7cGOOI0GRS+rc ",,,,False,False,False,False diff --git a/unittests/tools/test_generic_parser.py b/unittests/tools/test_generic_parser.py index bbd8d6e7ed2..b7fce8efed0 100644 --- a/unittests/tools/test_generic_parser.py +++ b/unittests/tools/test_generic_parser.py @@ -649,3 +649,12 @@ def test_parse_json_invalid_finding(self): with self.assertRaisesMessage(ValueError, "Not allowed fields are present: ['invalid_field', 'last_status_update']"): parser.get_findings(file, Test()) + + def test_parse_csv_with_epss(self): + with open("unittests/scans/generic/generic_csv_with_epss.csv", encoding="utf-8") as file: + parser = GenericParser() + findings = parser.get_findings(file, self.test) + self.assertEqual(1, len(findings)) + finding = findings[0] + self.assertEqual(.00042, finding.epss_score) + self.assertEqual(.23474, finding.epss_percentile)