Skip to content

Commit 1ba4ff4

Browse files
nscuronscuro
authored
Merge pull request #2432 from nscuro/prepare-4.7.1
Prepare v4.7.1
2 parents a3a01db + 1cabd0b commit 1ba4ff4

File tree

12 files changed

+259
-92
lines changed

12 files changed

+259
-92
lines changed

‎docs/_docs/getting-started/monitoring.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ system metrics via Prometheus is crucial for observability.
1515
> the application itself, not the data managed by it. If exposition of portfolio statistics via Prometheus is desired,
1616
> refer to [community integrations] like Jetstack's [dependency-track-exporter].
1717
18-
To enable metrics exposition, set the `alpine.metrics.enable` property to `true` (see [Configuration]).
18+
To enable metrics exposition, set the `alpine.metrics.enabled` property to `true` (see [Configuration]).
1919
Metrics will be exposed in the `/metrics` endpoint, and can optionally be protected using
2020
basic authentication via `alpine.metrics.auth.username` and `alpine.metrics.auth.password`.
2121

‎docs/_docs/usage/community-usage-examples.md

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
title: Community Usage Examples
3+
category: Usage
4+
chapter: 2
5+
order: 7
6+
---
7+
8+
This page lists various usage examples of Dependency-Track and its REST API that have been contributed by the community.
9+
10+
### Finding vulnerabilities from CISA KEV in Dependency-Track
11+
12+
> Contributed by [JoergBruenner](https://github.com/JoergBruenner)
13+
14+
CISA maintains a [catalog of known exploited vulnerabilities](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) (KEV).
15+
The following powershell script may be used to quickly identify projects in the Dependency-Track portfolio that are
16+
affected by vulnerabilities listed in KEV.
17+
18+
```powershell
19+
$api_base_url = 'http://localhost:8081'
20+
$api_key = 'changeit'
21+
22+
$urlCISA = 'https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json'
23+
$catalog = (Invoke-WebRequest -Uri $urlCISA -Method Get).content | ConvertFrom-Json
24+
25+
$headers = @{
26+
'accept' = 'application/json'
27+
'X-Api-Key' = $api_key
28+
}
29+
30+
foreach ($vulnerability in $catalog.vulnerabilities)
31+
{
32+
$uri = $api_base_url + "/api/v1/vulnerability/source/NVD/vuln/" + $vulnerability.cveID + "/projects"
33+
$response = ""
34+
35+
try
36+
{
37+
$response = Invoke-WebRequest -Uri $uri -Method Get -Headers $headers
38+
$affected_projects = $response | ConvertFrom-Json
39+
40+
if ($response.StatusCode -eq 200)
41+
{
42+
forEach ($project in $affected_projects)
43+
{
44+
$vulnerability.cveID + ': ' + $project.name + " v." + $project.version + " UUID: " + $project.uuid
45+
}
46+
}
47+
}
48+
catch
49+
{
50+
'[ERROR]: ' + $uri + ' / ' + $vulnerability.cveID + " : " + $response
51+
'[ERROR] ' + $_.Exception.Message
52+
'[ERROR] ' + $_.ScriptStackTrace
53+
}
54+
}
55+
```
56+
57+
### Creating Excel reports from EPSS data
58+
59+
> Contributed by [JoergBruenner](https://github.com/JoergBruenner)
60+
61+
The FIRST [exploit prediction scoring system](https://www.first.org/epss/) (EPSS) can help with prioritizing remediation
62+
efforts, by giving estimations of the likelihood that vulnerabilities are being exploited in the wild.
63+
Dependency-Track has native support for EPSS, and surfaces this data directly in the UI, or in its REST API.
64+
65+
> Note that EPSS is only supported for published CVEs. Vulnerabilities sourced from [GitHub Advisories], [OSV],
66+
> or [Snyk] will not have EPSS scores assigned to them.
67+
68+
The following Powershell script may be used to create an Excel report of all vulnerable components in the Dependency-Track
69+
portfolio, where both the CVSSv3 and EPSS scores exceed a given threshold. For each vulnerable component, the report
70+
will include identifiers of the component, the vulnerability it is affected by, the project the component belongs to,
71+
as well as the respective CVSSv3 and EPSS scores.
72+
73+
```powershell
74+
$api_base_url = 'http://localhost:8081'
75+
$api_key = 'changeit'
76+
$output_file = 'C:\temp\cvss-epss.xlsx'
77+
$cvssMin = 5
78+
$epssMin = 0.5
79+
$headers = @{
80+
'accept' = 'application/json'
81+
'X-Api-Key' = $api_key
82+
}
83+
84+
try
85+
{
86+
$my_excel = New-Object -ComObject excel.application
87+
$my_excel.visible = $false
88+
$my_workbook = $my_excel.workbooks.add()
89+
$sheet_1 = $my_workbook.worksheets.item(1)
90+
$sheet_1.name = "EPSS-CVSS"
91+
92+
$sheet_1.cells.item(1, 1) = 'NAME'
93+
$sheet_1.cells.item(1, 2) = 'VERSION'
94+
$sheet_1.cells.item(1, 3) = 'UUID'
95+
$sheet_1.cells.item(1, 4) = 'VULN-ID'
96+
$sheet_1.cells.item(1, 5) = 'CVSS'
97+
$sheet_1.cells.item(1, 6) = 'EPSS'
98+
$sheet_1.cells.item(1, 7) = 'COMPONENT-NAME'
99+
$sheet_1.cells.item(1, 8) = 'COMPONENT-VERSION'
100+
101+
$line = 2
102+
103+
$response = Invoke-WebRequest -Uri ($api_base_url + '/api/v1/project') -Method Get -Headers $headers
104+
$projects = $response | ConvertFrom-Json
105+
106+
foreach ($project in $projects)
107+
{
108+
$response = Invoke-WebRequest -Uri ($api_base_url + '/api/v1/vulnerability/project/' + $project.uuid) -Method Get -Headers $headers
109+
$vulns = $response | ConvertFrom-Json
110+
foreach ($vuln in $vulns)
111+
{
112+
$cvss = [Float]$vuln.cvssV3BaseScore
113+
$epss = [Float]$vuln.epssScore
114+
if (($cvss -gt $cvssMin) -and ( $epss -gt $epssMin))
115+
{
116+
foreach ($comp in $vuln.components)
117+
{
118+
$project.name + ";" + $project.version + ";" + $project.uuid + ";" + $vuln.vulnID + ";" + $vuln.cvssV3BaseScore + ";" + $vuln.epssScore + ";" + $comp.name + ";" + $comp.version
119+
120+
# Set text format
121+
$sheet_1.cells.item($line, 1).NumberFormat = "@"
122+
$sheet_1.cells.item($line, 1) = $project.name
123+
$sheet_1.cells.item($line, 2).NumberFormat = "@"
124+
$sheet_1.cells.item($line, 2) = $project.version
125+
126+
$sheet_1.cells.item($line, 3).NumberFormat = "@"
127+
$sheet_1.cells.item($line, 3) = $project.uuid
128+
$sheet_1.cells.item($line, 4).NumberFormat = "@"
129+
$sheet_1.cells.item($line, 4) = $vuln.vulnID
130+
$sheet_1.cells.item($line, 5).NumberFormat = "@"
131+
$sheet_1.cells.item($line, 5) = $vuln.cvssV3BaseScore
132+
$sheet_1.cells.item($line, 6).NumberFormat = "@"
133+
$sheet_1.cells.item($line, 6) = $vuln.epssScore
134+
$sheet_1.cells.item($line, 7).NumberFormat = "@"
135+
$sheet_1.cells.item($line, 7) = $comp.name
136+
$sheet_1.cells.item($line, 8).NumberFormat = "@"
137+
$sheet_1.cells.item($line, 8) = $comp.version
138+
$line++
139+
}
140+
}
141+
}
142+
}
143+
$my_workbook.Saveas($output_file)
144+
$my_excel.Quit()
145+
}
146+
catch
147+
{
148+
'error: ' + $response
149+
$_.Exception.Message
150+
$_.ScriptStackTrace
151+
}
152+
```
153+
154+
[GitHub Advisories]: {{ site.baseurl }}{% link _docs/datasources/github-advisories.md %}
155+
[OSV]: {{ site.baseurl }}{% link _docs/datasources/osv.md %}
156+
[Snyk]: {{ site.baseurl }}{% link _docs/datasources/snyk.md %}

‎docs/_docs/usage/executive-order-14028.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
title: U.S. Executive Order 14028
33
category: Usage
44
chapter: 2
5-
order: 7
5+
order: 6
66
---
77

88
Since its inception in 2013, OWASP Dependency-Track has been at the forefront of analyzing bill of materials for cybersecurity

‎docs/_docs/usage/usecases.md

Lines changed: 0 additions & 75 deletions
This file was deleted.

‎docs/_posts/2023-01-31-v4.7.1.md

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
---
2+
title: v4.7.1
3+
type: patch
4+
---
5+
6+
**Fixes:**
7+
8+
* Resolved a defect that caused BOM uploads to fail when the BOM file contained a byte order mark - [apiserver/#2312]
9+
* Resolved a defect that caused updating projects to fail when their `active` status was `null` - [apiserver/#2317]
10+
* Resolved a defect that prevented teams from being deleted when portfolio access control was enabled - [apiserver/#2374]
11+
* Move "Use Cases" documentation page to "Community Usage Examples" and clarify its purpose - [apiserver/#2403]
12+
* Resolved a defect that caused vulnerability alias synchronization to fail for VulnDB - [apiserver/#2428]
13+
* Fixed typo in monitoring documentation - [apiserver/#2430]
14+
* Resolved a defect that caused component details to not be displayed in policy violations tab - [frontend/#373]
15+
16+
For a complete list of changes, refer to the respective GitHub milestones:
17+
18+
* [API server milestone 4.7.1](https://github.com/DependencyTrack/dependency-track/milestone/31?closed=1)
19+
* [Frontend milestone 4.7.1](https://github.com/DependencyTrack/frontend/milestone/13?closed=1)
20+
21+
We thank all organizations and individuals who contributed to this release, from logging issues to taking part in discussions on GitHub & Slack to testing of fixes.
22+
Special thanks to everyone who contributed code to fix defects:
23+
24+
[@JoergBruenner], [@mehab], [@rbt-mm], [@sergioasantiago], [@syalioune]
25+
26+
###### dependency-track-apiserver.jar
27+
28+
| Algorithm | Checksum |
29+
|:----------|:---------|
30+
| SHA-1 | |
31+
| SHA-256 | |
32+
33+
###### dependency-track-bundled.jar
34+
35+
| Algorithm | Checksum |
36+
|:----------|:---------|
37+
| SHA-1 | |
38+
| SHA-256 | |
39+
40+
###### frontend-dist.zip
41+
42+
| Algorithm | Checksum |
43+
|:----------|:-----------------------------------------------------------------|
44+
| SHA-1 | 1c1412a09a64d08ae44cb3c9c980bfbb2786ff53 |
45+
| SHA-256 | 95aed5a69c6e1db5ab05eaa57f511d5e16f92bafd67839be63f136ea78e11252 |
46+
47+
48+
###### Software Bill of Materials (SBOM)
49+
50+
* API Server: [bom.json](https://github.com/DependencyTrack/dependency-track/releases/download/4.7.1/bom.json)
51+
* Frontend: [bom.json](https://github.com/DependencyTrack/frontend/releases/download/4.7.1/bom.json)
52+
53+
[apiserver/#2312]: https://github.com/DependencyTrack/dependency-track/issues/2312
54+
[apiserver/#2317]: https://github.com/DependencyTrack/dependency-track/issues/2317
55+
[apiserver/#2374]: https://github.com/DependencyTrack/dependency-track/issues/2374
56+
[apiserver/#2403]: https://github.com/DependencyTrack/dependency-track/pull/2403
57+
[apiserver/#2428]: https://github.com/DependencyTrack/dependency-track/pull/2428
58+
[apiserver/#2430]: https://github.com/DependencyTrack/dependency-track/pull/2430
59+
60+
[frontend/#373]: https://github.com/DependencyTrack/frontend/issues/373
61+
62+
[@JoergBruenner]: https://github.com/JoergBruenner
63+
[@mehab]: https://github.com/mehab
64+
[@rbt-mm]: https://github.com/rbt-mm
65+
[@sergioasantiago]: https://github.com/sergioasantiago
66+
[@syalioune]: https://github.com/syalioune

‎pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181

8282
<properties>
8383
<!-- Dependency Versions -->
84-
<frontend.version>4.7.0</frontend.version>
84+
<frontend.version>4.7.1</frontend.version>
8585
<lib.alpine.version>${project.parent.version}</lib.alpine.version>
8686
<lib.cpe-parser.version>2.0.2</lib.cpe-parser.version>
8787
<lib.cvss-calculator.version>1.4.1</lib.cvss-calculator.version>

‎src/main/java/org/dependencytrack/notification/NotificationRouter.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -226,7 +226,7 @@ private boolean checkIfChildrenAreAffected(Project parent, UUID uuid) {
226226
return false;
227227
}
228228
for (Project child : parent.getChildren()) {
229-
if ((child.getUuid().equals(uuid) && child.isActive()) || isChild) {
229+
if ((child.getUuid().equals(uuid) && Boolean.TRUE.equals(child.isActive())) || isChild) {
230230
return true;
231231
}
232232
isChild = checkIfChildrenAreAffected(child, uuid);

‎src/main/java/org/dependencytrack/persistence/ProjectQueryManager.java

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -487,10 +487,8 @@ public Project updateProject(UUID uuid, String name, String description, String
487487
project.setVersion(version);
488488
project.setPurl(purl);
489489

490-
if (!active && project.isActive() && hasActiveChild(project)){
490+
if (!active && Boolean.TRUE.equals(project.isActive()) && hasActiveChild(project)){
491491
throw new IllegalArgumentException("Project cannot be set to inactive, if active children are present.");
492-
} else {
493-
project.setActive(active);
494492
}
495493
project.setActive(active);
496494

@@ -522,10 +520,8 @@ public Project updateProject(Project transientProject, boolean commitIndex) {
522520
project.setPurl(transientProject.getPurl());
523521
project.setSwidTagId(transientProject.getSwidTagId());
524522

525-
if (project.isActive() && !Boolean.TRUE.equals(transientProject.isActive()) && hasActiveChild(project)){
523+
if (Boolean.TRUE.equals(project.isActive()) && !Boolean.TRUE.equals(transientProject.isActive()) && hasActiveChild(project)){
526524
throw new IllegalArgumentException("Project cannot be set to inactive if active children are present.");
527-
} else {
528-
project.setActive(transientProject.isActive());
529525
}
530526
project.setActive(transientProject.isActive());
531527

@@ -1091,7 +1087,7 @@ private static boolean hasActiveChild(Project project) {
10911087
boolean hasActiveChild = false;
10921088
if (project.getChildren() != null){
10931089
for (Project child: project.getChildren()) {
1094-
if (child.isActive() || hasActiveChild) {
1090+
if (Boolean.TRUE.equals(child.isActive()) || hasActiveChild) {
10951091
return true;
10961092
} else {
10971093
hasActiveChild = hasActiveChild(child);

‎src/main/java/org/dependencytrack/persistence/QueryManager.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1272,7 +1272,7 @@ public void recursivelyDeleteTeam(Team team) {
12721272
pm.currentTransaction().begin();
12731273
pm.deletePersistentAll(team.getApiKeys());
12741274
String aclDeleteQuery = """
1275-
DELETE FROM PROJECT_ACCESS_TEAMS WHERE \"PROJECT_ACCESS_TEAMS\".\"TEAM_ID\" = ?
1275+
DELETE FROM \"PROJECT_ACCESS_TEAMS\" WHERE \"PROJECT_ACCESS_TEAMS\".\"TEAM_ID\" = ?
12761276
""";
12771277
final Query query = pm.newQuery(JDOQuery.SQL_QUERY_LANGUAGE, aclDeleteQuery);
12781278
query.executeWithArray(team.getId());

‎src/main/java/org/dependencytrack/persistence/VulnerabilityQueryManager.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -560,11 +560,11 @@ public List<VulnerabilityAlias> getVulnerabilityAliases(Vulnerability vulnerabil
560560
} else if (Vulnerability.Source.SNYK.name().equals(vulnerability.getSource())) {
561561
query = pm.newQuery(VulnerabilityAlias.class, "snykId == :snykId");
562562
} else if (Vulnerability.Source.VULNDB.name().equals(vulnerability.getSource())) {
563-
query = pm.newQuery(VulnerabilityAlias.class, "vulnDb == :vulnDb");
563+
query = pm.newQuery(VulnerabilityAlias.class, "vulnDbId == :vulnDb");
564564
} else {
565565
query = pm.newQuery(VulnerabilityAlias.class, "internalId == :internalId");
566566
}
567-
return (List<VulnerabilityAlias>)query.execute(vulnerability.getVulnId());
567+
return (List<VulnerabilityAlias>)query.execute(vulnerability.getVulnId());
568568
}
569569

570570
/**

0 commit comments

Comments
 (0)