Release: Merge back 2.54.1 into dev from: master-into-dev/2.54.1-2.55.0-dev

[github-actions]

Release triggered by rossops

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[dryrunsecurity]

🔴 Risk threshold exceeded.

This pull request includes edits to several sensitive files (dojo/jira_link/helper.py, dojo/db_migrations/0255_remove_system_settings_product_grade.py, dojo/forms.py, dojo/models.py, dojo/utils.py) flagged by configured codepath checks and also registers System_Settings in the Django admin—potentially allowing staff with model permissions to access superuser-only secrets (jira_webhook_secret, slack_token, credentials). It also fixes a logic bug in the gcloud artifact severity mapper where uppercase "MINIMAL" is misclassified as Info instead of Low.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/db_migrations/0255_remove_system_settings_product_grade.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/forms.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/jira_link/helper.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

🔴 Configured Codepaths Edit in dojo/utils.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in .dryrunsecurity.yaml.

Unauthorized Access to System Settings via Admin Site in dojo/models.py

Vulnerability

Unauthorized Access to System Settings via Admin Site

Description

The registration of the System_Settings model in the Django Admin interface using admin.site.register(System_Settings) allows any user with staff access (is_staff=True) and the appropriate model-level permissions to view and modify global system configurations. This includes highly sensitive fields such as jira_webhook_secret, slack_token, and credentials. This registration bypasses the application's intended security model, as both the primary UI (dojo/system_settings/views.py) and the REST API (dojo/api_v2/views.py) explicitly restrict access to these settings to superusers only. Providing an alternative interface with more permissive access controls (Staff vs. Superuser) creates a privilege escalation path for staff users.

django-DefectDojo/dojo/models.py

Lines 4840 to 4846 in a8a8a1a

	admin.site.register(Tool_Type)
	admin.site.register(Cred_User)
	admin.site.register(Cred_Mapping)
	admin.site.register(System_Settings)
	admin.site.register(SLA_Configuration)
	admin.site.register(CWE)
	admin.site.register(Regulation)

Fragile Severity Mapping Logic Error in dojo/tools/gcloud_artifact_scan/parser.py

Vulnerability

Fragile Severity Mapping Logic Error

Description

The severity_mapper function contains a logic error in how it handles the 'Minimal' severity level from Google Cloud Artifact Scan. While it attempts to be case-insensitive for standard severities by using .lower().capitalize(), it checks for 'Minimal' using a case-sensitive equality operator (if severity == "Minimal":) after the first check fails. Since Google Cloud Artifact Scan typically uses uppercase 'MINIMAL' (as seen in the provided sample data), the first check fails because 'Minimal' is not in the set, and the second check fails because 'MINIMAL' != 'Minimal'. This causes 'MINIMAL' findings to fall through to the default 'Info' severity, effectively downgrading them from 'Low'.

django-DefectDojo/dojo/tools/gcloud_artifact_scan/parser.py

Lines 44 to 68 in a8a8a1a

	title=vuln["noteName"],
	test=test,
	description=description,
	severity=self.severity_mapper(severity),
	references=reference,
	component_name="affectedCPEUri: " + vuln["vulnerability"]["packageIssue"][0]["affectedCpeUri"] + " affectedPackage: " + vuln["vulnerability"]["packageIssue"][0]["affectedPackage"],
	component_version=vuln["vulnerability"]["packageIssue"][0]["affectedVersion"]["fullName"],
	static_finding=True,
	dynamic_finding=False,
	)
	if vuln["vulnerability"].get("fixAvailable"):
	finding.fix_available = vuln["vulnerability"].get("fixAvailable")
	if vuln["vulnerability"].get("cvssScore"):
	finding.cvssv3_score = vuln["vulnerability"].get("cvssScore")
	if vuln["vulnerability"]["shortDescription"]:
	finding.unsaved_vulnerability_ids = [vuln["vulnerability"]["shortDescription"]]
	findings.append(finding)
	return findings
	def severity_mapper(self, severity):
	if severity.lower().capitalize() in {"Critical", "High", "Medium", "Low", "Info"}:
	return severity.lower().capitalize()
	if severity == "Minimal":
	return "Low"
	return "Info"

We've notified @mtesauro.

---

All finding details can be found in the DryRun Security Dashboard.