Release: Merge release into master from: release/2.44.4

[github-actions]

Release triggered by rossops

[dryrunsecurity]

DryRun Security Summary

DefectDojo's codebase review revealed potential security risks including information exposure in GitLab DAST parser, unencrypted communication in test data, cryptographic weaknesses, and dependency management concerns.

Expand for full summary

Summary:
Multiple patches across DefectDojo's codebase introduce minor improvements, documentation updates, and version increments, with no critical security vulnerabilities directly identified.

Security Findings:

1. Potential Information Exposure in GitLab DAST Parser:

   • File: dojo/tools/gitlab_dast/parser.py
   • Risk: Method extracts full request and response headers
   • Potential Impact: Could expose sensitive information like authentication tokens or internal system details
   • Recommendation: Implement header sanitization before storage

2. Unencrypted Communication in Test JSON:

   • File: unittests/scans/gitlab_dast/issue_12050.json
   • Risk: Contains API endpoint using HTTP (not HTTPS)
   • Potential Impact: Vulnerable to man-in-the-middle attacks
   • Additional Risks:
     • Contains credit card number (PII)
     • Reveals internal hostname
     • Exposes authentication header

3. Cryptographic Weaknesses in SSL/TLS References:

   • File: unittests/scans/testssl/references.csv
   • Risks:
     • Presence of weak cipher suites (RC4, 3DES)
     • Support for outdated protocols (SSLv2, SSLv3)
     • Multiple cryptographic configuration issues
   • Potential Impact: Vulnerable to cryptographic attacks

4. Dependency Management Considerations:

   • File: components/package.json
   • Observations:
     • Some dependencies sourced directly from GitHub
     • Some dependencies using older versions
     • Potential indirect security risks in dependency management

No direct, immediately exploitable vulnerabilities were found, but several areas for potential security improvement were identified.

Code Analysis

We ran 7 analyzers against 25 files and 1 analyzer had findings. 6 analyzers had no findings.

Analyzer	Findings
Configured Codepaths Analyzer	1 finding

Overall Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro.

View PR in the DryRun Dashboard.