Add GLSA gentoo vulnid

[manuel-sommer]

Add GLSA gentoo vulnid and logic to resolve it.

[dryrunsecurity]

Hi there 👋, @DryRunSecurity here, below is a summary of our analysis and findings.

DryRun Security	Status	Findings
Sensitive Functions Analyzer	✅	0 findings
Configured Sensitive Files Analyzer	✅	0 findings
Sensitive Files Analyzer	❕	1 findings

Note

🟢 Risk threshold not exceeded.

Tip

Get answers to your security questions. Add a comment in this PR starting with @DryRunSecurity. For example...

@dryrunsecurity What are common security issues with web application cookies?

Powered by DryRun Security

[dryrunsecurity]

DryRun Security Summary

The pull request primarily focuses on updates to the configuration files and vulnerability URL handling in the DefectDojo application, improving the functionality and usability of the application, particularly in the area of vulnerability management and reporting, without introducing any obvious security vulnerabilities.

Expand for full summary

Summary:

The code changes in this pull request are primarily focused on updates to the configuration files and vulnerability URL handling in the DefectDojo application. The changes do not introduce any obvious security vulnerabilities, but they are important for ensuring the proper handling and display of vulnerability information to users.

The key changes include:

1. Update to the SHA-256 hash value of the dojo/settings/.settings.dist.py configuration file, indicating that the contents of the file have been modified.
2. Additions to the vulnerability_url function in the display_tags.py file to handle different types of vulnerability IDs and their corresponding URL formats, such as "GLSA", "AVD", "KHV", and "C-" prefixes.
3. Addition of a new vulnerability URL mapping for the "GLSA" (Gentoo Linux Security Advisories) vulnerability identifier in the dojo/settings/settings.dist.py configuration file.

These changes are primarily focused on improving the functionality and usability of the DefectDojo application, particularly in the area of vulnerability management and reporting. From an application security perspective, these changes do not introduce any immediate security concerns, but it is important to ensure that the new vulnerability URL mappings and handling are implemented correctly and securely.

Files Changed:

1. dojo/settings/.settings.dist.py.sha256sum: This file contains the SHA-256 hash of the dojo/settings/.settings.dist.py configuration file. The code change updates the hash value, indicating that the contents of the configuration file have been modified.
2. dojo/templatetags/display_tags.py: The changes in this file update the vulnerability_url function to handle different types of vulnerability IDs and their corresponding URL formats.
3. dojo/settings/settings.dist.py: This file is a configuration file for the DefectDojo application, and the changes introduce a new vulnerability URL mapping for the "GLSA" (Gentoo Linux Security Advisories) vulnerability identifier.

Code Analysis

We ran 9 analyzers against 3 files and 1 analyzer had findings. 8 analyzers had no findings.

Analyzer	Findings
Configured Codepaths Analyzer	3 findings

Riskiness

🔴 Risk threshold exceeded.

We've notified @mtesauro, @grendel513.

View PR in the DryRun Dashboard.

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[mtesauro]

Approved

[github-actions]

This pull request has conflicts, please resolve those before we can evaluate the pull request.

[github-actions]

Conflicts have been resolved. A maintainer will review the pull request shortly.

[manuel-sommer]

could we merge this please @mtesauro ?