🎉 ADD ELSA errata

[manuel-sommer]

No description provided.

[dryrunsecurity]

DryRun Security Summary

This pull request focuses on improving the security and functionality of the DefectDojo vulnerability management tool, with changes to the configuration files, the vulnerability_url function, and extensive updates to the settings.dist.py file to enhance features like SAML2 authentication, remote user authentication, deduplication, and security headers.

Expand for full summary

Summary:

The changes in this pull request appear to be focused on improving the security and functionality of the DefectDojo application, a vulnerability management tool. The key changes include:

1. Updates to the dojo/settings/.settings.dist.py.sha256sum file, which likely contains a hash of the dojo/settings/.settings.dist.py file. This change should be reviewed to ensure that the underlying configuration file has not been modified in a way that could introduce security vulnerabilities.

2. Enhancements to the vulnerability_url function in the display_tags.py file, which allows for more flexibility in constructing the URL for a given vulnerability ID. This change does not appear to introduce any security concerns.

3. Extensive updates to the dojo/settings/settings.dist.py file, which include support for SAML2 authentication, remote user authentication, deduplication configuration, hash code configuration, file upload type restrictions, Jira integration, and security headers. These changes are generally positive from an application security perspective, as they improve the overall security and functionality of the application.

Files Changed:

1. dojo/settings/.settings.dist.py.sha256sum: The hash value for the dojo/settings/.settings.dist.py file has been changed, which could indicate that the underlying configuration file has been modified. This change should be reviewed to ensure that no sensitive information has been exposed or compromised.

2. dojo/templatetags/display_tags.py: The vulnerability_url function has been updated to allow for more flexibility in constructing the URL for a given vulnerability ID. This change does not appear to introduce any security concerns.

3. dojo/settings/settings.dist.py: This file has been extensively updated to include support for SAML2 authentication, remote user authentication, deduplication configuration, hash code configuration, file upload type restrictions, Jira integration, and security headers. These changes are generally positive from an application security perspective, as they improve the overall security and functionality of the application.

Code Analysis

We ran 9 analyzers against 3 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Configured Codepaths Analyzer	2 findings

Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro, @grendel513.

View PR in the DryRun Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved