Release: Merge release into master from: release/2.50.2

[github-actions]

Release triggered by rossops

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request includes a flagged sensitive edit to dojo/jira_link/helper.py. It also introduces a potential denial‑of‑service in dojo/tools/generic/csv_parser.py (lines 81–106) where CVSSV4_score and kev_date are converted without proper error handling, so malformed values can raise ValueError/ParserError and crash the import process.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Denial of Service via Malformed CSV Input in dojo/tools/generic/csv_parser.py

Vulnerability	Denial of Service via Malformed CSV Input
Description	The CSV parser in dojo/tools/generic/csv_parser.py attempts to convert CVSSV4_score to a float and kev_date to a date object without proper error handling. Malformed input in these fields (e.g., non-numeric string for score, invalid date string for date) will cause unhandled ValueError or ParserError exceptions, leading to a crash of the import process.

django-DefectDojo/dojo/tools/generic/csv_parser.py

Lines 81 to 106 in 8a72a83

	if len(cvss_objects) > 0:
	finding.cvssv3 = cvss_objects[0].clean_vector()
	if "CVSSV4" in row:
	cvss4_objects = cvss_parser.parse_cvss_from_text(row["CVSSV4"])
	if len(cvss4_objects) > 0:
	finding.cvssv4 = cvss4_objects[0].clean_vector()
	if "CVSSV4_score" in row:
	finding.cvssv4_score = float(row["CVSSV4_score"])
	if "kev_date" in row:
	finding.kev_date = parse(row["kev_date"])
	if "known_exploited" in row:
	finding.known_exploited = bool(row["known_exploited"])
	if "ransomware_used" in row:
	finding.ransomware_used = bool(row["ransomware_used"])
	if "fix_available" in row:
	finding.fix_available = bool(row["fix_available"])
	# manage endpoints
	if "Url" in row:
	finding.unsaved_endpoints = [

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.