🎉 Advance reimport to update fix_available field #12633 #12922

manuel-sommer · 2025-08-04T20:20:18Z

I advanced fix_available to be updated within each reimport: Add "has fix" filter for CVE finding #12633 (comment)
I added field fix_version to populate a dedicated fixed version in the header of a finding. This field can also be used to be updated equal to fix_available within the reimport. An example screenshot can be found here:

- I added anchore grype to populate these fields

#12633 (comment)

manuel-sommer · 2025-08-04T20:20:48Z

@valentijnscholten is this the right direction for updating fix_available in reimport?

valentijnscholten · 2025-08-04T20:22:59Z

Yes

manuel-sommer · 2025-08-04T20:30:42Z

Shall I target this against bugfix, or do we want a longer testphase and keep it against dev?

dryrunsecurity · 2025-08-04T21:21:37Z

🔴 Risk threshold exceeded.

This pull request modifies several sensitive files (dojo/models.py, dojo/importers/default_reimporter.py, dojo/templates/dojo/view_finding.html, dojo/db_migrations/0247_remove_finding_insert_insert_and_more.py) flagged by the configured codepaths scanner and also includes a change in default_reimporter.py where the re-import process updates finding metadata (fix_available and fix_version) without explicit authorization checks, potentially allowing users with only scan import permissions to alter finding metadata. Please verify that these edits are intentional and either restrict the affected codepaths/authors in .dryrunsecurity.yaml or add proper authorization checks to prevent unauthorized metadata modification.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/db_migrations/0247_remove_finding_insert_insert_and_more.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/templates/dojo/view_finding.html

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/importers/default_reimporter.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

🔴 Configured Codepaths Edit in dojo/models.py

Vulnerability	Configured Codepaths Edit
Description	Sensitive edits detected for this file. Sensitive file paths and allowed authors can be configured in `.dryrunsecurity.yaml`.

Unauthorized Modification of Finding Metadata in dojo/importers/default_reimporter.py

Vulnerability	Unauthorized Modification of Finding Metadata
Description	The re-import process, triggered by a user with scan import permissions, updates the `fix_available` and `fix_version` fields of an existing finding. This update occurs within the `process_matched_active_finding` function without performing explicit authorization checks to ensure the user has the necessary permissions to directly edit the finding's metadata. This allows a user with potentially lower privileges (scan import) to modify critical information on a finding that they might not otherwise be authorized to change.

django-DefectDojo/dojo/importers/default_reimporter.py

Lines 599 to 601 in d82dfdd

    
           if existing_finding.fix_available != unsaved_finding.fix_available: 
        
               existing_finding.fix_available = unsaved_finding.fix_available 
        
               existing_finding.fix_version = unsaved_finding.fix_version

We've notified @mtesauro.

All finding details can be found in the DryRun Security Dashboard.

valentijnscholten · 2025-08-05T16:11:03Z

The main reason fields are not updated during reimport is that there's a risk it overwrites fields that were changed by the user. At least that's what I think the reason is. And this could be an issue here are the user may have set the fix_available field to None or False explicity. On the other hand we want to make that if a fix has become available we update the finding. What are your thoughts on this @Maffooch @mtesauro

manuel-sommer · 2025-08-05T19:31:27Z

I mean that is what is requested also in the linked issue explicitly.

valentijnscholten · 2025-08-06T19:11:27Z

We've discussed this and since this is sort of a "status" field or "meta" field it's OK to let reimport update it. Two remarks:

I think we would just always need to update it, so also the case where it goes from True to False (or to None)
I think it would have to be updated for any existing finding, so all branches of process_matched_finding.

Maffooch · 2025-08-07T06:21:07Z

We've discussed this and since this is sort of a "status" field or "meta" field it's OK to let reimport update it. Two remarks:

I think we would just always need to update it, so also the case where it goes from True to False (or to None)

I think it would have to be updated for any existing finding, so all branches of process_matched_finding.

I agree with this approach

manuel-sommer · 2025-08-26T04:44:11Z

Please review @valentijnscholten

manuel-sommer · 2025-08-26T07:09:09Z

Another point @valentijnscholten :
I can also remove the mitigation field from the deduplication settings in general and update it as well. Also take a look here:
#13053
#13055
With these two PRs, all mitigation fields in use would be removed from HASHCODE_FIELDS_PER_SCANNER in settings.dist.py
This enables us to update the mitigation field also as soon as a fix_available changes. These two fields often correlate.

valentijnscholten · 2025-08-27T10:03:16Z

Maybe start with just the fix_available field first as we are all in agreement that is good change to make.

manuel-sommer · 2025-08-28T08:28:51Z

Could we release this for the next release on Monday @mtesauro ?

valentijnscholten · 2025-10-31T16:00:49Z

@manuel-sommer I think this PR is a nice addition. Do you need any help to get across?

manuel-sommer · 2025-10-31T16:12:08Z

@valentijnscholten , as there were multiple rebases, the db migration causes these failures. I just rebased again and adapted the db migration, everything should be fine.

valentijnscholten

@manuel-sommer Can you regenerated the migrations? This is needed due to the addition of django-pghistory.

manuel-sommer · 2025-11-01T13:00:41Z

@manuel-sommer Can you regenerated the migrations? This is needed due to the addition of django-pghistory.

just regenerated a new migration @valentijnscholten

manuel-sommer · 2025-11-01T13:48:37Z

I would love to see this being released as I opened the PR already in August.

valentijnscholten

Approved. Do you think a small note in 2.52.md should be added to make users aware? It's the first time we let reimport override any non-status fields.

manuel-sommer · 2025-11-01T17:23:02Z

Approved. Do you think a small note in 2.52.md should be added to make users aware? It's the first time we let reimport override any non-status fields.

done @valentijnscholten

docs/content/en/open_source/upgrading/2.52.md

Reimport will update existing findings 'fix_available' and 'fix_version' fields based on the incoming scan report.

manuel-sommer · 2025-11-04T07:46:44Z

Updated the upgrading notes to 2.53

Just checking in to see if there's a timeline for the review. I'd really appreciate it if this could be merged soon – it would also save me from having to maintain the upgrade notes and db migrations every month. @mtesauro

github-actions bot added the docs label Aug 4, 2025

manuel-sommer marked this pull request as ready for review August 4, 2025 21:21

manuel-sommer requested review from Maffooch and mtesauro as code owners August 4, 2025 21:21

manuel-sommer force-pushed the reimport_fix_available branch from 7b12ecf to f32fa7a Compare August 26, 2025 04:33

manuel-sommer closed this Aug 26, 2025

manuel-sommer reopened this Aug 26, 2025

This was referenced Aug 26, 2025

🎉 Add fix_available to Harbor #13053

Merged

🎉 Add fix_available to KrakenDAudit #13055

Merged

manuel-sommer closed this Aug 27, 2025

manuel-sommer reopened this Aug 27, 2025

valentijnscholten added this to the 2.50.0 milestone Aug 28, 2025

github-actions bot added New Migration Adding a new migration file. Take care when merging. ui parser and removed parser labels Aug 28, 2025

manuel-sommer force-pushed the reimport_fix_available branch from c8edad7 to cc73836 Compare August 28, 2025 10:02

manuel-sommer mentioned this pull request Aug 28, 2025

🎉 Add fix_available to Trivy #13057

Merged

manuel-sommer and others added 2 commits October 31, 2025 17:08

Merge branch 'dev' into reimport_fix_available

93d91bb

update according to rebase

2dbbd39

Merge branch 'dev' into reimport_fix_available

bfa1d59

valentijnscholten requested changes Nov 1, 2025

View reviewed changes

update

f75e0b7

manuel-sommer requested a review from valentijnscholten November 1, 2025 13:00

valentijnscholten approved these changes Nov 1, 2025

View reviewed changes

update

2d25f3d

valentijnscholten reviewed Nov 1, 2025

View reviewed changes

docs/content/en/open_source/upgrading/2.52.md Outdated Show resolved Hide resolved

Clarify reimport behavior for findings update

8950a4c

Reimport will update existing findings 'fix_available' and 'fix_version' fields based on the incoming scan report.

valentijnscholten modified the milestones: 2.52.0, 2.53.0 Nov 3, 2025

manuel-sommer and others added 2 commits November 4, 2025 08:35

Merge branch 'dev' into reimport_fix_available

e336a64

update

165e13c

Maffooch approved these changes Nov 4, 2025

View reviewed changes

Maffooch requested review from blakeaowens and dogboat November 4, 2025 16:03

Merge branch 'dev' into reimport_fix_available

927dbc2

blakeaowens approved these changes Nov 4, 2025

View reviewed changes

Merge branch 'dev' into reimport_fix_available

d82dfdd

dogboat approved these changes Nov 5, 2025

View reviewed changes

valentijnscholten mentioned this pull request Nov 5, 2025

fix_available tag and fixable count not updating on re-import scans #13627

Closed

3 tasks

valentijnscholten merged commit 3052ac3 into DefectDojo:dev Nov 5, 2025
151 checks passed

manuel-sommer deleted the reimport_fix_available branch November 5, 2025 20:41

🎉 Advance reimport to update fix_available field #12633 #12922

🎉 Advance reimport to update fix_available field #12633 #12922

Uh oh!

Conversation

manuel-sommer commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

manuel-sommer commented Aug 4, 2025

Uh oh!

valentijnscholten commented Aug 4, 2025

Uh oh!

manuel-sommer commented Aug 4, 2025

Uh oh!

dryrunsecurity bot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🔴 Risk threshold exceeded.

Uh oh!

valentijnscholten commented Aug 5, 2025

Uh oh!

manuel-sommer commented Aug 5, 2025

Uh oh!

valentijnscholten commented Aug 6, 2025

Uh oh!

Maffooch commented Aug 7, 2025

Uh oh!

manuel-sommer commented Aug 26, 2025

Uh oh!

manuel-sommer commented Aug 26, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

valentijnscholten commented Aug 27, 2025

Uh oh!

manuel-sommer commented Aug 28, 2025

Uh oh!

valentijnscholten commented Oct 31, 2025

Uh oh!

manuel-sommer commented Oct 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

valentijnscholten left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-sommer commented Nov 1, 2025

Uh oh!

manuel-sommer commented Nov 1, 2025

Uh oh!

valentijnscholten left a comment

Choose a reason for hiding this comment

Uh oh!

manuel-sommer commented Nov 1, 2025

Uh oh!

Uh oh!

manuel-sommer commented Nov 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

manuel-sommer commented Aug 4, 2025 •

edited

Loading

dryrunsecurity bot commented Aug 4, 2025 •

edited

Loading

manuel-sommer commented Aug 26, 2025 •

edited

Loading

manuel-sommer commented Oct 31, 2025 •

edited

Loading

manuel-sommer commented Nov 4, 2025 •

edited

Loading