Skip to content

Release: Merge release into master from: release/2.48.1#12775

Merged
rossops merged 10 commits intomasterfrom
release/2.48.1
Jul 14, 2025
Merged

Release: Merge release into master from: release/2.48.1#12775
rossops merged 10 commits intomasterfrom
release/2.48.1

Conversation

@github-actions
Copy link
Copy Markdown
Contributor

Release triggered by rossops

DefectDojo release bot and others added 10 commits July 7, 2025 16:00
….49.0-dev

Release: Merge back 2.48.0 into bugfix from: master-into-bugfix/2.48.0-2.49.0-dev
Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
* zap: add req-resp unittest v2.26.1

* check number of req-resp pairs

* fix ports

* fix ports

* fix ports
* allow users with edit user permission to force password resets

* allow also for auth.add_user
* add deduplication hashcodes to docs

* add links

---------

Co-authored-by: Paul Osinski <paul.m.osinski@gmail.com>
* twistlock: parse compliances

* twistlock: finetune
@dryrunsecurity
Copy link
Copy Markdown

dryrunsecurity Bot commented Jul 14, 2025

DryRun Security

This pull request introduces documentation updates to the DefectDojo vulnerability management system, specifically adding sample scan data links and deduplication field details in the Burp parser documentation, which are considered informative and do not pose any security risks.

Documentation Information Exposure in docs/content/en/connecting_your_tools/parsers/file/burp.md
Vulnerability Documentation Information Exposure
Description The changes across multiple documentation files add sample scan data links and deduplication field details. While these changes provide transparency about the system's internal logic, they do not represent a significant security vulnerability. The links are to public GitHub repositories, and the deduplication fields are standard metadata used in vulnerability management systems. These disclosures help users understand how DefectDojo processes findings and are intentionally informative.

~~~
### Sample Scan Data
Sample Burp scans can be found [here](https://github.com/DefectDojo/django-DefectDojo/tree/master/unittests/scans/burp).
### Default Deduplication Hashcode Fields
By default, DefectDojo identifies duplicate Findings using these [hashcode fields](https://docs.defectdojo.com/en/working_with_findings/finding_deduplication/about_deduplication/):
- title
- severity
- vuln id from tool


All finding details can be found in the DryRun Security Dashboard.

@rossops rossops closed this Jul 14, 2025
@rossops rossops reopened this Jul 14, 2025
@rossops rossops merged commit 25abde2 into master Jul 14, 2025
85 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants