Deprecate Python-jose and migrate okta to python_social_auth #10117

manuel-sommer · 2024-05-04T19:15:04Z

Python-jose can be deprecated if we switch to python_social_auth

dryrunsecurity · 2024-05-04T19:15:25Z

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Server-Side Request Forgery Analyzer	✅	0 findings
Configured Codepaths Analyzer	❌	2 findings
IDOR Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 finding
SQL Injection Analyzer	✅	0 findings
Authn/Authz Analyzer	❕	1 finding
Secrets Analyzer	✅	0 findings

Note

🔴 Risk threshold exceeded. Adding a reviewer if one is configured in .dryrunsecurity.yaml.

notification list: @mtesauro @grendel513

Change Summary (click to expand)

The following is a summary of changes in this pull request made by me, your security buddy 🤖. Note that this summary is auto-generated and not meant to be a definitive list of security issues but rather a helpful summary from a security perspective.

Summary:

The changes in this pull request focus on updating the authentication backends, modifying a settings file hash, and updating the project's dependencies. From an application security perspective, these changes appear to be positive improvements that enhance the security of the DefectDojo application.

The key changes include replacing the custom 'dojo.okta.OktaOAuth2' backend with the more widely-used 'social_core.backends.okta.OktaOAuth2' backend, which may provide better security practices and bug fixes. The order of the authentication backends has also been updated, which can be important for security.

Additionally, the changes to the requirements.txt file show that the project is using secure libraries, such as argon2-cffi for password hashing and djangosaml2 for SAML2 authentication. The removal of the Python-jose library, which has had security vulnerabilities in the past, is also a positive security improvement.

Overall, these changes seem to be focused on improving the security of the DefectDojo application by updating authentication mechanisms, verifying the integrity of configuration files, and maintaining secure dependencies.

Files Changed:

dojo/settings/settings.dist.py: This file has been updated to replace the 'dojo.okta.OktaOAuth2' backend with the 'social_core.backends.okta.OktaOAuth2' backend and change the order of the authentication backends.
dojo/settings/.settings.dist.py.sha256sum: The SHA-256 hash value for the .settings.dist.py file has been updated, indicating that the contents of the settings file have been modified.
requirements.txt: The project's dependencies have been updated, including the removal of the Python-jose library and the inclusion of several security-related libraries, such as cryptography, PyJWT, and argon2-cffi.

Powered by DryRun Security

manuel-sommer · 2024-05-04T19:23:30Z

I just saw that python-jose is used

django-DefectDojo/dojo/okta.py

Line 8 in f66e6db

from jose import jwt

We also have PyJWT in requirements.txt How about migrating okta.py to PyJWT?

What is your opinion @Maffooch and @cneill ?

manuel-sommer · 2024-05-04T19:59:25Z

https://nvd.nist.gov/vuln/detail/CVE-2024-33664
https://nvd.nist.gov/vuln/detail/CVE-2024-33663

Maffooch · 2024-05-06T16:07:56Z

We could probably get rid of our version of the okta backend and instead use https://github.com/python-social-auth/social-core/blob/master/social_core/backends/okta.py

At the time, the PR to add the okta backend https://github.com/python-social-auth/social-core was not getting in quick enough for DefectDojo, so we copied the code, and pasted it in here

manuel-sommer · 2024-05-14T07:35:41Z

Done @Maffooch. Could you give me feedback here?

github-actions · 2024-06-21T21:59:36Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

manuel-sommer · 2024-07-02T09:01:31Z

As soon as you start reviewing it, I will resolve the conflicts here @Maffooch. Otherwise, I might have to resolve conflicts multiple times.

Maffooch

Thank you for your patience @manuel-sommer this one got a little burried

github-actions · 2024-07-03T06:55:17Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

github-actions · 2024-07-03T20:19:31Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

mtesauro · 2024-07-03T21:19:58Z

@manuel-sommer Mind fixing the merge conflicts on this one so we can work on getting the remaining approvals?

github-actions · 2024-07-03T21:44:17Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

manuel-sommer · 2024-07-03T21:44:42Z

Done @mtesauro

mtesauro

Approved

dryrunsecurity · 2024-07-11T06:44:19Z

DryRun Security Summary

The pull request focuses on several security-related updates to the DefectDojo application, including an authentication backend update, dependency updates, and an integrity verification update that raises some security concerns.

Expand for full summary

Summary:

The code changes in this pull request focus on several security-related updates to the DefectDojo application:

Authentication Backend Update: The change in the authentication backend from "dojo.okta.OktaOAuth2" to "social_core.backends.okta.OktaOAuth2" is a positive security improvement, as it uses a more widely-used and maintained authentication library, which can help prevent potential security vulnerabilities.
Dependency Updates: The changes to the requirements.txt file suggest that the application is undergoing updates to its security-related functionality, including improvements to software component management, vulnerability tracking, and user authentication. The removal of the Python-jose library and the addition of several new libraries, such as argon2-cffi and django-ratelimit, indicate a focus on enhancing the application's security posture.
Integrity Verification Update: The change to the dojo/settings/.settings.dist.py.sha256sum file raises some security concerns, as it could potentially allow an attacker to modify the settings.dist.py file without being detected. This highlights the importance of implementing a robust integrity verification process to ensure the security of the application's configuration files.

Files Changed:

dojo/settings/settings.dist.py: The changes in this file update the authentication backend for the DefectDojo application, replacing the "dojo.okta.OktaOAuth2" backend with the "social_core.backends.okta.OktaOAuth2" backend. This is a positive security improvement, as it uses a more widely-used and maintained authentication library.
requirements.txt: The changes in this file remove the Python-jose library and add several new libraries, such as cpe, packageurl-python, django-ratelimit, and argon2-cffi. These changes suggest that the application is undergoing updates to its security-related functionality, including improvements to software component management, vulnerability tracking, and user authentication.
dojo/settings/.settings.dist.py.sha256sum: The changes in this file update the SHA-256 checksum for the settings.dist.py file, indicating that the contents of the file have been modified. This raises some security concerns, as it could potentially allow an attacker to modify the settings.dist.py file without being detected.

Code Analysis

We ran 7 analyzers against 4 files and 3 analyzers had findings. 4 analyzers had no findings.

Analyzer	Findings
Configured Codepaths Analyzer	2 findings
Sensitive Files Analyzer	1 finding
Authn/Authz Analyzer	1 finding

Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro, @grendel513.

View PR in the DryRun Dashboard.

manuel-sommer · 2024-07-12T19:11:54Z

Awesome, that we can get this on the road :-)

github-actions · 2024-07-12T22:25:45Z

This pull request has conflicts, please resolve those before we can evaluate the pull request.

mtesauro · 2024-07-12T23:00:27Z

@manuel-sommer Was about to merge this since it has 4 approvals - mind fixing the merge conflicts

github-actions · 2024-07-13T00:50:27Z

Conflicts have been resolved. A maintainer will review the pull request shortly.

manuel-sommer · 2024-07-13T00:51:32Z

Done @mtesauro

mtesauro · 2024-07-13T01:44:33Z

@manuel-sommer
Thank you sir!

… kiuwan-sca # By dependabot[bot] (13) and others # Via GitHub * 'kiuwan-sca' of github.com:mwager/django-DefectDojo: (39 commits) Deprecate Python-jose and migrate okta to python_social_auth (DefectDojo#10117) fix: dockerfile warnings (DefectDojo#10505) Ruff: Add and fix Q000 (DefectDojo#10095) Fix(django): Upgrade of 4.2 (DefectDojo#10553) fix(deps): build python psycopg3 dependency instead of use the pre-build binary (DefectDojo#10491) Bump coverage from 7.5.4 to 7.6.0 (DefectDojo#10560) Bump asteval from 1.0.0 to 1.0.1 (DefectDojo#10561) Bump djangorestframework from 3.14.0 to 3.15.2 (DefectDojo#10431) Bump boto3 from 1.34.142 to 1.34.143 (DefectDojo#10558) Bump django-debug-toolbar from 4.4.5 to 4.4.6 (DefectDojo#10557) Bump boto3 from 1.34.141 to 1.34.142 (DefectDojo#10551) Bump packageurl-python from 0.15.2 to 0.15.3 (DefectDojo#10541) Bump boto3 from 1.34.140 to 1.34.141 (DefectDojo#10542) Update helm lock file Update versions in application files Update versions in application files API: Convert get_filterset calls to get_queryset (DefectDojo#10543) Bump django-debug-toolbar from 4.4.4 to 4.4.5 (DefectDojo#10527) Fix ruff Ruff fix ... # Conflicts: # dojo/settings/.settings.dist.py.sha256sum

manuel-sommer marked this pull request as draft May 4, 2024 19:24

manuel-sommer closed this May 6, 2024

manuel-sommer reopened this May 6, 2024

manuel-sommer force-pushed the rm_pythonjose branch 2 times, most recently from 99d717f to 9b39a66 Compare May 14, 2024 07:25

github-actions bot added the settings_changes Needs changes to settings.py based on changes in settings.dist.py included in this PR label May 14, 2024

manuel-sommer changed the title ~~remove Python-jose~~ Deprecate Python-jose and migrate okta to python_social_auth May 14, 2024

manuel-sommer marked this pull request as ready for review May 14, 2024 07:31

manuel-sommer force-pushed the rm_pythonjose branch from 8c47756 to 908d443 Compare June 21, 2024 10:33

github-actions bot added the conflicts-detected label Jun 21, 2024

Maffooch approved these changes Jul 3, 2024

View reviewed changes

manuel-sommer force-pushed the rm_pythonjose branch from 5796680 to 7590c67 Compare July 3, 2024 06:55

github-actions bot added conflicts-detected and removed conflicts-detected labels Jul 3, 2024

manuel-sommer force-pushed the rm_pythonjose branch from 878efa5 to e6513b1 Compare July 3, 2024 21:44

github-actions bot removed the conflicts-detected label Jul 3, 2024

mtesauro approved these changes Jul 4, 2024

View reviewed changes

cneill approved these changes Jul 10, 2024

View reviewed changes

manuel-sommer force-pushed the rm_pythonjose branch from 62a394b to fe9dbb3 Compare July 11, 2024 06:44

grendel513 approved these changes Jul 12, 2024

View reviewed changes

github-actions bot added the conflicts-detected label Jul 12, 2024

manuel-sommer added 3 commits July 13, 2024 02:45

remove Python-jose

4885a34

replace okta.py

1ddba7f

switch to python-social-auth for okta

272e121

manuel-sommer force-pushed the rm_pythonjose branch from fe9dbb3 to 272e121 Compare July 13, 2024 00:50

github-actions bot removed the conflicts-detected label Jul 13, 2024

done

0c49807

mtesauro merged commit ca07945 into DefectDojo:dev Jul 13, 2024
122 of 123 checks passed

manuel-sommer deleted the rm_pythonjose branch July 13, 2024 07:22

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Deprecate Python-jose and migrate okta to python_social_auth #10117

Deprecate Python-jose and migrate okta to python_social_auth #10117

manuel-sommer commented May 4, 2024 •

edited

Loading

dryrunsecurity bot commented May 4, 2024 •

edited

Loading

manuel-sommer commented May 4, 2024

manuel-sommer commented May 4, 2024

Maffooch commented May 6, 2024

manuel-sommer commented May 14, 2024

github-actions bot commented Jun 21, 2024

manuel-sommer commented Jul 2, 2024

Maffooch left a comment

github-actions bot commented Jul 3, 2024

github-actions bot commented Jul 3, 2024

mtesauro commented Jul 3, 2024

github-actions bot commented Jul 3, 2024

manuel-sommer commented Jul 3, 2024

mtesauro left a comment

dryrunsecurity bot commented Jul 11, 2024 •

edited

Loading

manuel-sommer commented Jul 12, 2024

github-actions bot commented Jul 12, 2024

mtesauro commented Jul 12, 2024

github-actions bot commented Jul 13, 2024

manuel-sommer commented Jul 13, 2024

mtesauro commented Jul 13, 2024

Deprecate Python-jose and migrate okta to python_social_auth #10117

Deprecate Python-jose and migrate okta to python_social_auth #10117

Conversation

manuel-sommer commented May 4, 2024 • edited Loading

dryrunsecurity bot commented May 4, 2024 • edited Loading

manuel-sommer commented May 4, 2024

manuel-sommer commented May 4, 2024

Maffooch commented May 6, 2024

manuel-sommer commented May 14, 2024

github-actions bot commented Jun 21, 2024

manuel-sommer commented Jul 2, 2024

Maffooch left a comment

Choose a reason for hiding this comment

github-actions bot commented Jul 3, 2024

github-actions bot commented Jul 3, 2024

mtesauro commented Jul 3, 2024

github-actions bot commented Jul 3, 2024

manuel-sommer commented Jul 3, 2024

mtesauro left a comment

Choose a reason for hiding this comment

dryrunsecurity bot commented Jul 11, 2024 • edited Loading

DryRun Security Summary

Code Analysis

Riskiness

manuel-sommer commented Jul 12, 2024

github-actions bot commented Jul 12, 2024

mtesauro commented Jul 12, 2024

github-actions bot commented Jul 13, 2024

manuel-sommer commented Jul 13, 2024

mtesauro commented Jul 13, 2024

manuel-sommer commented May 4, 2024 •

edited

Loading

dryrunsecurity bot commented May 4, 2024 •

edited

Loading

dryrunsecurity bot commented Jul 11, 2024 •

edited

Loading