Release Notes: 2.43.3

[paulOsinski]

Updating release notes for February releases 2.43.[0-3].

[sc-10206]

[dryrunsecurity]

DryRun Security Summary

DefectDojo Pro v2.43 introduces various API, UI, and connector updates that enhance functionality but also present potential security concerns around access control, data exposure, and vulnerability tracking.

Expand for full summary

DefectDojo Pro v2.43 introduces API, UI, and connector updates with enhancements to finding management and tool integrations. Security findings include:

1. /audit_log API endpoint potentially exposes sensitive user activity information if improperly access-controlled
2. Manual Vulnerability ID editing introduces potential tracking/identification risks
3. Minimum severity connector settings could lead to overlooking lower-severity findings
4. New API endpoints and manual editing features increase potential attack surface
5. Audit log endpoint might reveal sensitive user activity details
6. Multiple new UI features suggest potential need for strict role-based access controls and permission management

Code Analysis

We ran 9 analyzers against 1 file and 0 analyzers had findings. 9 analyzers had no findings.

View PR in the DryRun Dashboard.

[mtesauro]

Approved