Release: Merge back 2.48.2 into dev from: master-into-dev/2.48.2-2.49.0-dev #12823

github-actions · 2025-07-21T16:31:03Z

Release triggered by rossops

….49.0-dev Release: Merge back 2.48.1 into bugfix from: master-into-bugfix/2.48.1-2.49.0-dev

* reimport: close_old_findings must respect service field * reimport: close_old_findings must respect service field * close_old_findings: update docs and help texts * typo * reimport docs tweak * reimport: assert that reopen respect service field

* add display of kev data to findings listing and filtering * kev date filter to use date widget * define labels for kev date filter * change column title for kev date * add before/after filters for kev date

* update minimum and maximum password length validation in system settings form * update minimum and maximum password length validation in system settings serializer * Apply suggestions from code review * Update dojo/api_v2/serializers.py * move validation to model * fix ruff * add migration

…12812)

* twistlock: fix no cvss case * twistlock: use markdown instead html

* view_test: use subquery for finding counts * fix two more group by errors * change all counts to subqueries * fix query

* sysdig parsers: stop using spaces in tags * add clean_tags method * sysdig: clean tags * add migration to clean invalid characters * api edgescan: use unsaved_tags * edgescan test case fix * force parsers to use unsaved_tags * fix tag=None cleaning and validation * fix []!=None * restore reimport tag behaviour * finetune * rename upgrade notes

Release: Merge release into master from: release/2.48.2

github-actions · 2025-07-21T16:31:51Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

dryrunsecurity · 2025-07-21T16:34:22Z

🔴 Risk threshold exceeded.

This pull request contains multiple sensitive file edits across various components of the Dojo application, including views, models, and utility files, with potential security considerations around password policy, privilege escalation in scan imports, and a supply chain risk in GitHub Actions configuration.

🔴 Configured Codepaths Edit in dojo/search/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/findings_list_snippet.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/test/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/api_v2/serializers.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/db_migrations/0234_alter_system_settings_maximum_password_length_and_more.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/endpoint/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/engagement/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/filters.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding/queries.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/finding_group/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_importer.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/endpoint_manager.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/product/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/product_type/views.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

Weak Password Policy Configuration in dojo/db_migrations/0234_alter_system_settings_maximum_password_length_and_more.py

Vulnerability	Weak Password Policy Configuration
Description	The current maximum password length of 48 characters, while preventing some DoS attacks, is lower than modern security recommendations. OWASP, referencing NIST 800-63B, suggests a minimum of 64 characters to accommodate passphrases. For common hashing algorithms like bcrypt, a limit of 72 bytes is typical. The current limit unnecessarily restricts users from creating longer, more secure passphrases without a clear technical justification from the provided code snippets (e.g., database column size or hashing algorithm limitation).

django-DefectDojo/dojo/db_migrations/0234_alter_system_settings_maximum_password_length_and_more.py

Lines 1 to 24 in caf7372

    
           # Generated by Django 5.1.8 on 2025-07-17 20:45 
        
           import django.core.validators 
        
           from django.db import migrations, models 
        
           class Migration(migrations.Migration): 
        
               dependencies = [ 
        
                   ('dojo', '0233_remove_test_actual_time_remove_test_estimated_time'), 
        
               ] 
        
               operations = [ 
        
                   migrations.AlterField( 
        
                       model_name='system_settings', 
        
                       name='maximum_password_length', 
        
                       field=models.IntegerField(default=48, help_text='Requires user to set passwords less than maximum length.', validators=[django.core.validators.MinValueValidator(9), django.core.validators.MaxValueValidator(48)], verbose_name='Maximum password length'), 
        
                   ), 
        
                   migrations.AlterField( 
        
                       model_name='system_settings', 
        
                       name='minimum_password_length', 
        
                       field=models.IntegerField(default=9, help_text='Requires user to set passwords greater than minimum length.', validators=[django.core.validators.MinValueValidator(9), django.core.validators.MaxValueValidator(48)], verbose_name='Minimum password length'), 
        
                   ), 
        
               ]

Privilege Escalation via Form Field in dojo/forms.py

Vulnerability	Privilege Escalation via Form Field
Description	The `ReImportScanForm` includes a `close_old_findings` field which, when set to `True`, causes the re-importer to close findings that are no longer present in the imported scan. The `ReImportScanResultsView` (which processes this form) only checks for `Permissions.Import_Scan_Result`. The `API_Importer` role has `Permissions.Import_Scan_Result` but does not have `Permissions.Finding_Edit` (which is required to close/mitigate findings). Therefore, a user with the `API_Importer` role could potentially upload a scan with `close_old_findings` enabled, effectively closing findings they are not authorized to close, leading to a privilege escalation.

django-DefectDojo/dojo/forms.py

Lines 674 to 680 in caf7372

    
               label="Choose report file", 
        
               allow_empty_file=True, 
        
               required=False) 
        
           close_old_findings = forms.BooleanField(help_text="Select if old findings in the same test that are no longer present in the report get closed as mitigated when importing.", 
        
                                                   required=False, initial=True) 
        
           version = forms.CharField(max_length=100, required=False, help_text="Version that will be set on existing Test object. Leave empty to leave existing value in place.") 
        
           branch_tag = forms.CharField(max_length=100, required=False, help_text="Branch or Tag that was scanned.")

Supply Chain Risk in .github/workflows/close-stale.yml

Vulnerability	Supply Chain Risk
Description	The use of `actions/stale@v9` introduces a supply chain risk. While using third-party GitHub Actions is common, pinning to a mutable tag (`@v9`) means that the action's code can change without explicit review, potentially introducing vulnerabilities or malicious code. Best practices for GitHub Actions recommend pinning to a full commit SHA to ensure immutability and prevent unexpected changes. Additionally, the action is granted `issues: write` and `pull-requests: write` permissions, which are necessary for its intended functionality but represent a significant privilege. A compromise of the action or a malicious update could lead to unauthorized modifications of issues and pull requests in the repository. Although no specific vulnerabilities for `actions/stale@v9` were found in the available databases, the general risk associated with mutable action versions and broad write permissions remains.

django-DefectDojo/.github/workflows/close-stale.yml

Lines 1 to 27 in caf7372

    
           name: Close Stale Issues and PRs 
        
           on: 
        
             schedule: 
        
               # Run daily at 02:00 UTC 
        
               - cron: '0 2 * * *' 
        
             workflow_dispatch: 
        
               # Allow manual triggering 
        
           permissions: 
        
             issues: write 
        
             pull-requests: write 
        
           jobs: 
        
             close-stale: 
        
               runs-on: ubuntu-latest 
        
               steps: 
        
                 - name: Close stale issues and PRs 
        
                   uses: actions/stale@v9 
        
                   with: 
        
                     # Disable automatic stale marking - only close manually labeled items 
        
                     days-before-stale: -1 
        
                     days-before-close: 7 
        
                     stale-issue-label: 'stale' 
        
                     stale-pr-label: 'stale' 
        
                     close-issue-message: 'This issue has been automatically closed because it was manually labeled as stale. If you believe this was closed in error, please reopen it and remove the stale label.' 
        
                     close-pr-message: 'This PR has been automatically closed because it was manually labeled as stale. If you believe this was closed in error, please reopen it and remove the stale label.'

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

github-actions · 2025-07-21T16:43:14Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2025-07-21T16:43:16Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

…Dojo/django-DefectDojo into master-into-dev/2.48.2-2.49.0-dev

DefectDojo release bot and others added 15 commits July 14, 2025 15:05

Update versions in application files

bced353

Merge pull request #12779 from DefectDojo/master-into-bugfix/2.48.1-2…

b5f3286

….49.0-dev Release: Merge back 2.48.1 into bugfix from: master-into-bugfix/2.48.1-2.49.0-dev

Make KEV data visible on findings listing (#12785)

88716e5

* add display of kev data to findings listing and filtering * kev date filter to use date widget * define labels for kev date filter * change column title for kev date * add before/after filters for kev date

🎉 add GSD vulnid (#12794)

c481048

ms_defender: skip empty files from zip (#12780)

0e99640

github action: close manually marked stale issues/prs after 7 days (#…

0d8cdfa

…12812)

sysdig: support 2025 formats (#12810)

a0d5a03

bugfix: twistlock: fix no cvss case (#12809)

ae90b6b

* twistlock: fix no cvss case * twistlock: use markdown instead html

bugfix: use subquery for (finding) counts (#12784)

0948ad3

* view_test: use subquery for finding counts * fix two more group by errors * change all counts to subqueries * fix query

Update versions in application files

fa98bed

Merge pull request #12822 from DefectDojo/release/2.48.2

d005afe

Release: Merge release into master from: release/2.48.2

Update versions in application files

6d72c33

github-actions bot requested review from Maffooch and mtesauro as code owners July 21, 2025 16:31

github-actions bot added the conflicts-detected label Jul 21, 2025

Merge branch 'dev' into master-into-dev/2.48.2-2.49.0-dev

2d03441

github-actions bot added New Migration Adding a new migration file. Take care when merging. settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR apiv2 conflicts-detected docs unittests ui and removed conflicts-detected labels Jul 21, 2025

github-actions bot added parser helm and removed conflicts-detected labels Jul 21, 2025

Maffooch and others added 5 commits July 21, 2025 10:44

Update migrations

cf68f0a

Fixing lint issue

a5b9193

Missed migration

84e9952

Fixing ruff

b366785

Merge branch 'master-into-dev/2.48.2-2.49.0-dev' of github.com:Defect…

caf7372

…Dojo/django-DefectDojo into master-into-dev/2.48.2-2.49.0-dev

Maffooch merged commit dae9299 into dev Jul 21, 2025
88 checks passed

Maffooch deleted the master-into-dev/2.48.2-2.49.0-dev branch July 21, 2025 18:00

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Release: Merge back 2.48.2 into dev from: master-into-dev/2.48.2-2.49.0-dev #12823

Release: Merge back 2.48.2 into dev from: master-into-dev/2.48.2-2.49.0-dev #12823

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

dryrunsecurity bot commented Jul 21, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

Release: Merge back 2.48.2 into dev from: master-into-dev/2.48.2-2.49.0-dev #12823

Release: Merge back 2.48.2 into dev from: master-into-dev/2.48.2-2.49.0-dev #12823

Uh oh!

Conversation

github-actions bot commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

dryrunsecurity bot commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Risk threshold exceeded.

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

github-actions bot commented Jul 21, 2025

Uh oh!

Uh oh!

Uh oh!

dryrunsecurity bot commented Jul 21, 2025 •

edited

Loading