add DLA security advisory

[manuel-sommer]

No description provided.

[dryrunsecurity]

DryRun Security Summary

The pull request enhances the vulnerability detection capabilities of the DefectDojo application by adding support for the Debian Security Tracker (DLA) and updating the SHA-256 checksum file for the configuration file, improving the overall security of the application.

Expand for full summary

Summary:

The changes in this pull request are focused on enhancing the vulnerability detection capabilities of the DefectDojo application by adding support for a new vulnerability source, the Debian Security Tracker (DLA). This change is a positive security improvement, as it will allow DefectDojo to provide users with more comprehensive vulnerability data, including details specific to Debian-based Linux distributions.

Additionally, the pull request includes an update to the SHA-256 checksum file for the dojo/settings/.settings.dist.py configuration file. This change ensures that the integrity of the configuration file can be verified, which is a common security practice. While the checksum update itself does not introduce any obvious security concerns, it is important to review the actual changes made to the configuration file to ensure that no security-sensitive settings have been modified in a way that could introduce vulnerabilities or security risks.

Files Changed:

1. dojo/settings/settings.dist.py:

   • This file has been updated to include a new entry in the VULNERABILITY_URLS dictionary, which maps vulnerability IDs to their corresponding URLs from the Debian Security Tracker (DLA).
   • This change is a positive security improvement, as it expands the coverage of vulnerability information available to DefectDojo users.

2. dojo/settings/.settings.dist.py.sha256sum:

   • The SHA-256 checksum for the dojo/settings/.settings.dist.py file has been updated from 6cd4cfc4ae1dc8f89a2d28122705df499b12efae6993c60aa205661cffea2220 to 4d3e91f176b73278750dc2f46d27cd4fe2b47d24682ad06d6267880bbdec599c.
   • This change confirms that the contents of the dojo/settings/.settings.dist.py file have been modified, and the checksum has been updated to reflect the changes.

Code Analysis

We ran 9 analyzers against 2 files and 0 analyzers had findings. 9 analyzers had no findings.

Riskiness

🟢 Risk threshold not exceeded.

View PR in the DryRun Dashboard.

[mtesauro]

Approved