-
Notifications
You must be signed in to change notification settings - Fork 1.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Enhance OSV Parser to Include Mitigation Information with Fixed Package Versions #11459
Conversation
… (fixed versions)
… (fixed versions)
DryRun Security SummaryThe pull request includes various updates to the DefectDojo application, focusing on dependency management, documentation improvements, and feature enhancements, with no major security concerns identified. Expand for full summarySummary: The code changes in this pull request cover a wide range of updates, including dependency version updates, documentation improvements, and feature enhancements across the DefectDojo application. From an application security perspective, the changes do not introduce any major security concerns, but there are a few areas that warrant further review and consideration:
Overall, the changes in this pull request appear to be focused on improving the functionality, usability, and documentation of the DefectDojo application. From an application security perspective, the changes do not raise any immediate red flags, but it's important to continue monitoring the development and deployment of these features to ensure that the application's security posture is maintained. Files Changed:
Code AnalysisWe ran
|
@4b75726169736859 You appear to have far more files in the PR than you should. Can you look at only including files related to your OSV parser changes. |
* add release notes for 2.41.4 * Update changelog.md --------- Co-authored-by: Paul Osinski <[email protected]>
* update docs 'jira' * rename finding_status_definitions * update docs 'working with Findings' * update docs 'dashboard-notifications' * reorganize sidebar * add emoji logos to headers * fix broken links * rm 'upgrading' pages from search results * rm aws ami reference * Update docs/content/en/customize_dojo/dashboard_notifications/about_custom_dashboard_tiles.md Co-authored-by: Charles Neill <[email protected]> * Update docs/content/en/customize_dojo/dashboard_notifications/about_custom_dashboard_tiles.md Co-authored-by: Charles Neill <[email protected]> * Update about_notifications.md * update dashboard tiles article * finish notifications QA --------- Co-authored-by: Paul Osinski <[email protected]> Co-authored-by: Charles Neill <[email protected]>
@@ -70,8 +76,11 @@ def get_findings(self, file, test): | |||
file_path=source_path, | |||
references=reference, | |||
) | |||
if mitigation: | |||
finding.mitigation = mitigation |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please also add unittests to your PR.
Release: Merge release into master from: release/2.42.0
….43.0-dev Release: Merge back 2.42.0 into bugfix from: master-into-bugfix/2.42.0-2.43.0-dev
* add back ldap-authentication.md * add back api-v2-docs.md * update broken readme links --------- Co-authored-by: Paul Osinski <[email protected]>
Release: Merge release into master from: release/2.42.1
* update Pro changelog 2.42.0 * qa 'share your Findings' * changelog 2.42.2 * fix typo working_with_generated_reports.md --------- Co-authored-by: Paul Osinski <[email protected]>
This pull request aligns with the current contribution guidelines by enhancing the OSV parser. The changes introduce mitigation details for vulnerabilities.
Description
This pull request enhances the
OSC Scan
parser by adding support for mitigation information, specifically the fixed versions of affected packages.Key Changes:
Extraction of Fixed Versions:
ranges
field within theaffected
section of each vulnerability.fixed
version from theevents
list when available and formatted it as:Upgrade to version: <fixed_version>
.Integration of Mitigation:
mitigation
field in findings to provide actionable guidance for resolving vulnerabilities.Enhanced Usability:
Testing Support:
Test Results
Testing was conducted using the provided sample JSON file (
test.json
). The parser correctly identifies findings and includes mitigation details in its output.Example Output:
CVE-2024-50252_linux
Medium
Upgrade to version: 6.1.119-1
Additionally, I verified that:
Unit tests are planned to extend
dojo/unittests
for comprehensive coverage of these changes.Documentation
The documentation has been updated to reflect this new feature:
Checklist
dev
branch.flake8
and Python 3.11 compliant.Labels
Import Scans
,enhancement
Extra Information
This pull request enhances the usability of the OSV parser, making it more actionable by including mitigation details. It also aligns with existing parsers, such as WPScan, which already support fixed versions, ensuring consistency across DefectDojo.
If you need further clarifications or adjustments, feel free to let me know!