Release: Merge back 2.49.3 into dev from: master-into-dev/2.49.3-2.50.0-dev

[github-actions]

Release triggered by rossops

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dryrunsecurity]

This pull request contains a potential uncontrolled resource consumption vulnerability in the zip file processing logic, where an attacker could potentially create a malicious zip file that could cause a Denial of Service by overwhelming system resources, though the current risk is assessed as passing and non-blocking.

Uncontrolled Resource Consumption (Zip Bomb) in dojo/tools/blackduck_component_risk/importer.py

Vulnerability	Uncontrolled Resource Consumption (Zip Bomb)
Description	The code processes zip files without implementing checks for the uncompressed size of files or the total number of files within the archive. This allows an attacker to craft a malicious zip file (a 'zip bomb') that, when processed, could lead to excessive memory consumption or CPU usage, resulting in a Denial of Service (DoS) for the application.

django-DefectDojo/dojo/tools/blackduck_component_risk/importer.py

Lines 42 to 48 in ddb34aa

	components = {}
	source = {}
	try:
	with zipfile.ZipFile(report) as zipf:
	c_file = False
	s_file = False
	for full_file_name in zipf.namelist():

---

All finding details can be found in the DryRun Security Dashboard.