Thanks to visit codestin.com
Credit goes to github.com

Skip to content

upgrade notes: correct dedupe command lines #12007

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged

Conversation

valentijnscholten
Copy link
Member

@valentijnscholten valentijnscholten commented Mar 13, 2025

Some small fixes here mainly around quoting.

@github-actions github-actions bot added the docs label Mar 13, 2025
Copy link

dryrunsecurity bot commented Mar 13, 2025

DryRun Security Summary

Documentation updates for DefectDojo versions 2.42-2.44 address potential security risks related to command execution and parser name injection in Docker containers, emphasizing the need for careful administrative control.

Expand for full summary
  1. Summary: Documentation updates for DefectDojo versions 2.42, 2.43, and 2.44, focusing on syntax changes for Docker Compose commands related to hash code recalculation for various security scanners.

  2. Security Findings:

  • Potential command execution risk in Docker container's uwsgi service when running dedupe.py management command
  • Potential parser name injection vector if input is not properly sanitized
  • Recommendation to ensure these commands are only executable by authorized administrators

Note: While no direct critical vulnerabilities were found, the security considerations around command execution and potential injection were highlighted across the documentation patches.

View PR in the DryRun Dashboard.

Copy link
Contributor

@dogboat dogboat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are the backticks still desired? The newline/indents already get a code/paragraph that stands out. Preview:

Screenshot 2025-03-13 at 3 45 42 PM

@valentijnscholten
Copy link
Member Author

Are the backticks still desired? The newline/indents already get a code/paragraph that stands out. Preview:

Good point, a shame github doesn't render the preview for us in the PR :-)

Removed. Also changed 2.44.x to 2.44.0.

Copy link
Contributor

@dogboat dogboat left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cool, thanks! Looks great, appreciate it!

@Maffooch Maffooch merged commit b3623a6 into DefectDojo:bugfix Mar 13, 2025
77 checks passed
valentijnscholten added a commit to valentijnscholten/django-DefectDojo that referenced this pull request Mar 15, 2025
* upgrade notes: correct dedupe command lines

* upgrade notes: unquote
iago-r pushed a commit to iago-r/django-DefectDojo that referenced this pull request Mar 27, 2025
* upgrade notes: correct dedupe command lines

* upgrade notes: unquote
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

6 participants