Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Release Notes: 2.43.3 #11857

Merged
merged 4 commits into from
Feb 21, 2025
Merged

Release Notes: 2.43.3 #11857

merged 4 commits into from
Feb 21, 2025

Conversation

paulOsinski
Copy link
Contributor

@paulOsinski paulOsinski commented Feb 19, 2025

Updating release notes for February releases 2.43.[0-3].

[sc-10206]

@github-actions github-actions bot added the docs label Feb 19, 2025
Copy link

DryRun Security Summary

DefectDojo Pro v2.43 introduces various API, UI, and connector updates that enhance functionality but also present potential security concerns around access control, data exposure, and vulnerability tracking.

Expand for full summary

DefectDojo Pro v2.43 introduces API, UI, and connector updates with enhancements to finding management and tool integrations. Security findings include:

  1. /audit_log API endpoint potentially exposes sensitive user activity information if improperly access-controlled
  2. Manual Vulnerability ID editing introduces potential tracking/identification risks
  3. Minimum severity connector settings could lead to overlooking lower-severity findings
  4. New API endpoints and manual editing features increase potential attack surface
  5. Audit log endpoint might reveal sensitive user activity details
  6. Multiple new UI features suggest potential need for strict role-based access controls and permission management

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@Maffooch Maffooch merged commit e920a1b into DefectDojo:master Feb 21, 2025
71 of 72 checks passed
valentijnscholten pushed a commit that referenced this pull request Feb 22, 2025
* add 2.43.0 changelog

* add 2.43.1

* v2.43.2

* 2.43.3

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
Maffooch added a commit that referenced this pull request Feb 24, 2025
….0-dev (#11888)

* Update versions in application files

* Return Feedback about wrong File Format in ZAP (#11772)

* Return Feedback about wrong File Format in ZAP

* ruff

* Surveys: Correct Question 404 (#11862)

* Surveys: Correct Question 404

When editing a survey question, a 404 is presented for a valid object. At some point, the content type for Questions changed to `Defect Dojo` (the verbose name of the app) rather than `dojo` (the common name)

There is only one place where the name of the content type is accessed, so adding some backward compatible checks corrected the issue

[sc-10195]

* Update views.py

* API Tags: Add filter for `AND` expressions (#11743)

* API Tags: Add filter for `AND` expressions

* Fix some ruff stuff

* Small corrections

* Update dojo/filters.py

* Release Notes: 2.43.3 (#11857)

* add 2.43.0 changelog

* add 2.43.1

* v2.43.2

* 2.43.3

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

* Docs Updates: Feb (#11791)

* exclude archived docs from search

* rm index files from search results

* fix typo - CWE to CVE

* update external_tools.md with additional windows options

* remove outdated github.io links

* specify that EPSS sync is pro-only

* add universal parser documentation

* add beta notice to Universal Parser

* Update universal_parser.md

* add back defectdojo.com/pricing links

* add scss change to fix 'central column' issue

* add rules engine Pro documentation

* change casing for screenshots

* create pro features list, add to header

* Rename Enabling_Deduplication_within_an_Engagement.png to enabling_deduplication_within_an_engagement.png

* Rename Enabling_Deduplication_within_an_Engagement_2.png to enabling_deduplication_within_an_engagement_2.png

* Rename Enabling_Deduplication_within_an_Engagement_3.png to enabling_deduplication_within_an_engagement_3.png

* Rename Enabling_Deduplication_within_an_Engagement_4.png to enabling_deduplication_within_an_engagement_4.png

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>

* Feb docs hotfix (#11870)

* Rename Enabling_Product-Level_Deduplication.png to enabling_product-level_deduplication.png

* Rename Enabling_Product-Level_Deduplication_2.png to enabling_product-level_ceduplication_2.png

* Rename enabling_product-level_ceduplication_2.png to enabling_product-level_deduplication_2.png

* Update versions in application files

* Update versions in application files

* Fixing flake 8

---------

Co-authored-by: DefectDojo release bot <dojo-release-bot@users.noreply.github.com>
Co-authored-by: Cody Maffucci <46459665+Maffooch@users.noreply.github.com>
Co-authored-by: manuelsommer <47991713+manuel-sommer@users.noreply.github.com>
Co-authored-by: Paul Osinski <42211303+paulOsinski@users.noreply.github.com>
Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
Co-authored-by: Ross E Esposito <ross@defectdojo.com>
quirinziessler pushed a commit to quirinziessler/django-DefectDojo that referenced this pull request Feb 26, 2025
* add 2.43.0 changelog

* add 2.43.1

* v2.43.2

* 2.43.3

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants