{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>D\u016fle\u017eitost anal\u00fdzy t\u0159et\u00edch stran softwarov\u00fdch komponent (angl. Software Composition Analysis \u2014 SCA) v procesu v\u00fdvoje roste s ka\u017edoro\u010dn\u00edmi zpr\u00e1vami o zranitelnostech open source knihoven, kter\u00e9 publikuj\u00ed spole\u010dnosti Synopsys, Sonatype, Snyk, White Source. Podle zpr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Stav zranitelnost\u00ed open source bezpe\u010dnosti 2020<\/a><\/noindex> po\u010det odhalen\u00fdch zranitelnost\u00ed v open source v roce 2019 vzrostl t\u00e9m\u011b\u0159 o 1,5kr\u00e1t ve srovn\u00e1n\u00ed s p\u0159edchoz\u00edm rokem, zat\u00edmco komponenty s otev\u0159en\u00fdm k\u00f3dem se pou\u017e\u00edvaj\u00ed v 60 % a\u017e 80 % projekt\u016f. Pokud se obr\u00e1t\u00edme na nez\u00e1visl\u00e9 n\u00e1zory, procesy SCA jsou jednotlivou praktikou OWASP SAMM a BSIMM jako ukazatel zralosti, a v prvn\u00ed polovin\u011b roku 2020 OWASP vydala nov\u00fd standard OWASP Software Component Verification Standard (SCVS), kter\u00fd poskytuje osv\u011bd\u010den\u00e9 postupy pro ov\u011b\u0159ov\u00e1n\u00ed t\u0159et\u00edch stran komponent v dodavatelsk\u00e9m \u0159et\u011bzci softwaru.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/2a82121d42f9d317f3862a2d7869fdd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nJedn\u00edm z nejv\u00fdznamn\u011bj\u0161\u00edch p\u0159\u00edpad\u016f <noindex><a rel=\"nofollow\" href=\"https:\/\/xakep.ru\/2017\/09\/14\/equifax-dejstvitelno-vzlomali-cherez-bag-v-apache-struts-no-uyazvimost-okazalas-staroj\/\">do\u0161lo<\/a><\/noindex> s spole\u010dnost\u00ed Equifax v kv\u011btnu 2017. Nezn\u00e1m\u00ed \u00fato\u010dn\u00edci z\u00edskali informace o 143 milionech Ameri\u010dan\u016f, v\u010detn\u011b pln\u00fdch jmen, adres, \u010d\u00edsel soci\u00e1ln\u00edho zabezpe\u010den\u00ed a \u0159idi\u010dsk\u00fdch pr\u016fkaz\u016f. V 209 000 p\u0159\u00edpadech se v dokumentech tak\u00e9 objevily informace o platebn\u00edch kart\u00e1ch ob\u011bt\u00ed. Tento \u00fanik vznikl v d\u016fsledku zneu\u017eit\u00ed kritick\u00e9 zranitelnosti v Apache Struts 2 (CVE-2017-5638), p\u0159i\u010dem\u017e oprava byla vyd\u00e1na ji\u017e v b\u0159eznu 2017. Spole\u010dnost m\u011bla dva m\u011bs\u00edce na instalaci aktualizace, av\u0161ak nikdo se t\u00edm nezaob\u00edral.<\/p>\n<p>V tomto \u010dl\u00e1nku se bude diskutovat o v\u00fdb\u011bru n\u00e1stroje pro prov\u00e1d\u011bn\u00ed SCA z pohledu kvality analyzovan\u00fdch v\u00fdsledk\u016f. Tak\u00e9 bude uvedeno funk\u010dn\u00ed porovn\u00e1n\u00ed n\u00e1stroj\u016f. Proces integrace do CI\/CD a mo\u017enosti integrace ponech\u00e1me na dal\u0161\u00ed publikace. \u0160irok\u00fd seznam n\u00e1stroj\u016f byl p\u0159edstaven OWASP <noindex><a rel=\"nofollow\" href=\"https:\/\/owasp.org\/www-community\/Component_Analysis\">na sv\u00fdch str\u00e1nk\u00e1ch<\/a><\/noindex>, ale v r\u00e1mci tohoto p\u0159ehledu se dotkneme pouze nejpopul\u00e1rn\u011bj\u0161\u00edho open source n\u00e1stroje Dependency Check, o n\u011bco m\u00e9n\u011b zn\u00e1m\u00e9 open source platformy Dependency Track a enterprise \u0159e\u0161en\u00ed Sonatype Nexus IQ. Tak\u00e9 si vysv\u011btl\u00edme, jak tato \u0159e\u0161en\u00ed funguj\u00ed a porovn\u00e1me z\u00edskan\u00e9 v\u00fdsledky z hlediska fale\u0161n\u00fdch pozitiv.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/0580758082abd9950aa9c483d546f1ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Princip pr\u00e1ce<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/jeremylong.github.io\/DependencyCheck\/\">Dependency Check<\/a><\/noindex> \u2014 je to n\u00e1stroj (CLI, maven, jenkins modul, ant), kter\u00fd analyzuje soubory projektu, shroma\u017e\u010fuje fragmenty informac\u00ed o z\u00e1vislostech (n\u00e1zev bal\u00ed\u010dku, groupid, specifikace n\u00e1zvu, verze\u2026), vytv\u00e1\u0159\u00ed \u0159et\u011bzec CPE \u2014 (Common Platform Enumeration), Package URL (PURL) a identifikuje pro CPE\/PURL zranitelnosti z datab\u00e1z\u00ed (NVD, Sonatype OSS Index, NPM Audit API\u2026), po \u010dem\u017e vytv\u00e1\u0159\u00ed jednor\u00e1zovou zpr\u00e1vu ve form\u00e1tu HTML, JSON, XML\u2026<\/p>\n<p>Pod\u00edvejme se, jak vypad\u00e1 CPE:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Part:<\/b> Ur\u010den\u00ed, \u017ee komponenta pat\u0159\u00ed k aplikaci (a), opera\u010dn\u00edmu syst\u00e9mu (o), hardwaru (h) (Povinn\u00fd \u00fadaj)<\/li>\n<li><b>Vendor:<\/b> N\u00e1zev v\u00fdrobce produktu (Povinn\u00fd \u00fadaj)<\/li>\n<li><b>Product:<\/b> N\u00e1zev produktu (Povinn\u00fd \u00fadaj)<\/li>\n<li><b>Version:<\/b> Verze komponenty (Zastaral\u00fd \u00fadaj)<\/li>\n<li><b>Update:<\/b> Aktualizace bal\u00ed\u010dku<\/li>\n<li><b>Edition:<\/b> D\u011bd\u011bn\u00e1 verze (Zastaral\u00fd \u00fadaj)<\/li>\n<li><b>Language:<\/b> Jazyk definovan\u00fd v RFC-5646<\/li>\n<li><b>SW Edition:<\/b> Verze softwaru<\/li>\n<li><b>Target SW:<\/b> Softwarov\u00e9 prost\u0159ed\u00ed, ve kter\u00e9m produkt funguje<\/li>\n<li><b>Target HW:<\/b> Hardwarov\u00e9 prost\u0159ed\u00ed, ve kter\u00e9m produkt funguje<\/li>\n<li><b>Other:<\/b> Informace o dodavateli nebo produktu<\/li>\n<\/ul>\n<p>\nP\u0159\u00edklad CPE vypad\u00e1 takto:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*<\/code><\/pre>\n<p>\n\u0158et\u011bzec znamen\u00e1, \u017ee CPE verze 2.3 popisuje komponentu aplikace od v\u00fdrobce <code>pivotal_software <\/code>s n\u00e1zvem <code>spring_framework<\/code> verze 3.0.0. Pokud otev\u0159eme zranitelnost <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0225\">CVE-2014-0225<\/a><\/noindex> v NVD, m\u016f\u017eeme vid\u011bt zm\u00ednku o t\u00e9to CPE. Prvn\u00ed probl\u00e9m, na kter\u00fd bychom se m\u011bli zam\u011b\u0159it \u2014 CVE v NVD podle CPE informuje o probl\u00e9mu v r\u00e1mci frameworku, nikoli v konkr\u00e9tn\u00ed komponent\u011b. To znamen\u00e1, \u017ee pokud jsou v\u00fdvoj\u00e1\u0159i \u00fazce spjati s frameworkem, a zji\u0161t\u011bn\u00e1 zranitelnost se net\u00fdk\u00e1 t\u011bch modul\u016f, kter\u00e9 pou\u017e\u00edvaj\u00ed, specialistovi na bezpe\u010dnost se tak \u010di onak bude muset zab\u00fdvat touto CVE a p\u0159em\u00fd\u0161let o aktualizaci.<\/p>\n<p>URL adresa se tak\u00e9 pou\u017e\u00edv\u00e1 n\u00e1stroji SCA. Form\u00e1t URL adresy bal\u00ed\u010dku je n\u00e1sleduj\u00edc\u00ed:<\/p>\n<pre><code class=\"plaintext\">scheme:type\/namespace\/name@version?qualifiers#subpath<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Scheme: <\/b>V\u017edy bude 'pkg', kter\u00fd ud\u00e1v\u00e1, \u017ee se jedn\u00e1 o adresu bal\u00ed\u010dku (Povinn\u00e1 polo\u017eka)<\/li>\n<li><b>Type:<\/b> \u201eTyp\u201c bal\u00ed\u010dku nebo \u201eprotokol\u201c bal\u00ed\u010dku, nap\u0159\u00edklad maven, npm, nuget, gem, pypi atd. (Povinn\u00fd \u00fadaj)<\/li>\n<li><b>Namespace:<\/b> N\u011bjak\u00e1 p\u0159edpona n\u00e1zvu, jako je identifik\u00e1tor skupiny Maven, vlastn\u00edk Docker obrazu, u\u017eivatel nebo organizace GitHub. Nepovinn\u00e9 a z\u00e1visl\u00e9 na typu.<\/li>\n<li><b>Name:<\/b> N\u00e1zev bal\u00ed\u010dku (Povinn\u00fd \u00fadaj)<\/li>\n<li><b>Version:<\/b> Verze bal\u00ed\u010dku<\/li>\n<li><b>Qualifiers:<\/b> Dal\u0161\u00ed kvalifika\u010dn\u00ed \u00fadaje pro bal\u00ed\u010dek, jako jsou opera\u010dn\u00ed syst\u00e9m, architektura, distribuce atd. Nepovinn\u00e9 a z\u00e1visl\u00e9 na typu polo\u017eky.<\/li>\n<li><b>Subcesta:<\/b> Dal\u0161\u00ed cesta v bal\u00ed\u010dku vzhledem k ko\u0159eni bal\u00ed\u010dku<\/li>\n<\/ul>\n<p>\nNap\u0159\u00edklad:<\/p>\n<pre><code class=\"plaintext\">pkg:golang\/google.golang.org\/genproto#googleapis\/api\/annotations\npkg:maven\/org.apache.commons\/io@1.3.4\npkg:pypi\/django-package@1.11.1.dev1<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/dependencytrack.org\/\">Dependency Track<\/a><\/noindex> \u2014 on-premise webov\u00e1 platforma, kter\u00e1 p\u0159ij\u00edm\u00e1 hotov\u00e9 sestavy materi\u00e1l\u016f (BOM) vytvo\u0159en\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/CycloneDX\">CycloneDX<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/spdx.org\/licenses\/\">SPDX<\/a><\/noindex>, tedy hotov\u00e9 specifikace o existuj\u00edc\u00edch z\u00e1vislostech. Toto je XML soubor s popisem z\u00e1vislost\u00ed \u2014 n\u00e1zev, hashe, URL bal\u00ed\u010dku, vydavatel, licence. Pot\u00e9 Dependency Track analyzuje BOM, zkoum\u00e1 existuj\u00edc\u00ed zji\u0161t\u011bn\u00e9 z\u00e1vislosti CVE z datab\u00e1ze zranitelnost\u00ed (NVD, Sonatype OSS Index \u2026), po \u010dem\u017e vytv\u00e1\u0159\u00ed grafy, po\u010d\u00edt\u00e1 metriky a pravideln\u011b aktualizuje \u00fadaje o stavu zranitelnosti komponent. <\/p>\n<p>P\u0159\u00edklad toho, jak m\u016f\u017ee vypadat BOM ve form\u00e1tu XML:<\/p>\n<pre><code class=\"xml\">Apache\n      org.apache.tomcat\n      tomcat-catalina\n      9.0.14\n      \n        3942447fac867ae5cdb3229b658f4d48\n        e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a\n        f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b\n        e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282\n      \n      \n        \n          Apache-2.0\n        \n      \n      pkg:maven\/org.apache.tomcat\/tomcat-catalina@9.0.14\n    \n      <!-- More components here --><\/code><\/pre>\n<p>\nBOM m\u016f\u017ee b\u00fdt pou\u017e\u00edv\u00e1n nejen jako vstupn\u00ed parametry pro Dependency Track, ale tak\u00e9 pro inventarizaci komponent\u016f SW v dodavatelsk\u00e9m \u0159et\u011bzci, nap\u0159\u00edklad pro poskytov\u00e1n\u00ed z\u00e1kazn\u00edkovi SW. V roce 2014 byl ve Spojen\u00fdch st\u00e1tech navr\u017een z\u00e1kon <noindex><a rel=\"nofollow\" href=\"https:\/\/www.congress.gov\/bill\/113th-congress\/house-bill\/5793\">\u201eCyber Supply Chain Management and Transparency Act of 2014\u201c<\/a><\/noindex>, kter\u00fd uv\u00e1d\u011bl, \u017ee p\u0159i n\u00e1kupu SW mus\u00ed ka\u017ed\u00e1 vl\u00e1dn\u00ed instituce po\u017eadovat BOM, aby se zabr\u00e1nilo pou\u017eit\u00ed zraniteln\u00fdch komponent\u016f, av\u0161ak z\u00e1kon nakonec nenabyl \u00fa\u010dinnosti.<\/p>\n<p>Pokud se vr\u00e1t\u00edme k SCA, Dependency Track m\u00e1 p\u0159ipraven\u00e9 integrace s notifika\u010dn\u00edmi platformami jako Slack, syst\u00e9my spr\u00e1vy zranitelnost\u00ed jako Kenna Security. Je tak\u00e9 t\u0159eba zm\u00ednit, \u017ee Dependency Track nav\u00edc identifikuje zastaral\u00e9 verze bal\u00ed\u010dk\u016f a poskytuje informace o licenc\u00edch (d\u00edky podpo\u0159e SPDX).<\/p>\n<p>Pokud jde konkr\u00e9tn\u011b o kvalitu SCA, existuje zde z\u00e1sadn\u00ed rozd\u00edl.<\/p>\n<p>Dependency Track nep\u0159ij\u00edm\u00e1 projekt jako vstupn\u00ed data, ale p\u0159ij\u00edm\u00e1 BOM. To znamen\u00e1, \u017ee pokud chceme zkontrolovat projekt, mus\u00edme nejprve vygenerovat bom.xml, nap\u0159\u00edklad pomoc\u00ed CycloneDX. T\u00edmto zp\u016fsobem Dependency Track p\u0159\u00edmo z\u00e1vis\u00ed na CycloneDX. Na druhou stranu to d\u00e1v\u00e1 mo\u017enost p\u0159izp\u016fsoben\u00ed. Tak t\u00fdm OZON napsal <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ozonru\/cyclonedx-go\">modul CycloneDX<\/a><\/noindex> pro vytv\u00e1\u0159en\u00ed BOM soubor\u016f pro projekty v Golangu s c\u00edlem dal\u0161\u00edho skenov\u00e1n\u00ed prost\u0159ednictv\u00edm Dependency Track.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/sonatype.ru\/#nexusiq\">Nexus IQ<\/a><\/noindex> je komer\u010dn\u00ed \u0159e\u0161en\u00ed SCA od spole\u010dnosti Sonatype, kter\u00e9 je sou\u010d\u00e1st\u00ed ekosyst\u00e9mu Sonatype, kam tak\u00e9 pat\u0159\u00ed Nexus Repository Manager. Nexus IQ m\u016f\u017ee p\u0159ij\u00edmat jako vstupn\u00ed data jak war archivy (pro java projekty) p\u0159es webov\u00e9 rozhran\u00ed nebo API, tak i BOM, pokud se va\u0161e organizace nestihla p\u0159eorientovat z CycloneDX na nov\u00e9 \u0159e\u0161en\u00ed. Na rozd\u00edl od open source \u0159e\u0161en\u00ed, IQ se nezam\u011b\u0159uje pouze na CP\/PURL k zji\u0161t\u011bn\u00e9 komponent\u011b a odpov\u00eddaj\u00edc\u00ed zranitelnosti v datab\u00e1zi, ale bere v \u00favahu i vlastn\u00ed v\u00fdzkumy, nap\u0159\u00edklad n\u00e1zev zraniteln\u00e9 funkce nebo t\u0159\u00eddy. Mechanismy IQ budou podrobn\u011bji probr\u00e1ny pozd\u011bji p\u0159i anal\u00fdze v\u00fdsledk\u016f.<\/p>\n<p>Shrneme n\u011bkter\u00e9 z\u00e1v\u011bry ohledn\u011b funk\u010dn\u00edch vlastnost\u00ed a tak\u00e9 prozkoum\u00e1me podporovan\u00e9 jazyky pro anal\u00fdzu:<\/p>\n<p>Jazyk<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Javy<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>C\/C++<br \/>\n+<br \/>\n+<br \/>\n&#8212;<\/p>\n<p>C#<br \/>\n+<br \/>\n+<br \/>\n&#8212;<\/p>\n<p>.Net<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Erlang<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>JavaScript (NodeJS)<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>PHP<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>CouchDB<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Ruby<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Perl<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Scala<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Objective C<br \/>\n+<br \/>\n+<br \/>\n&#8212;<\/p>\n<p>Swift<br \/>\n+<br \/>\n+<br \/>\n&#8212;<\/p>\n<p>R<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Go<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>\nFunk\u010dn\u00ed mo\u017enosti<\/p>\n<p>Funk\u010dn\u00ed mo\u017enosti<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Mo\u017enost prov\u00e1d\u011bt kontrolu komponent pou\u017e\u00edvan\u00fdch v zdrojov\u00e9m k\u00f3du na licen\u010dn\u00ed \u010distotu<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>Mo\u017enost skenov\u00e1n\u00ed a anal\u00fdzy zranitelnost\u00ed a licen\u010dn\u00ed \u010distoty pro Docker obrazy<br \/>\n+ Integrace s Clair<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Mo\u017enost nastaven\u00ed bezpe\u010dnostn\u00ed politiky pro pou\u017e\u00edv\u00e1n\u00ed knihoven s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Mo\u017enost skenov\u00e1n\u00ed repozit\u00e1\u0159\u016f s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem na p\u0159\u00edtomnost zraniteln\u00fdch komponent<br \/>\n+ RubyGems, Maven, NPM, Nuget, Pypi, Conan, Bower, Conda, Go, p2, R, Yum, Helm, Docker, CocoaPods, Git LFS<br \/>\n&#8212;<br \/>\n+ Hex, RubyGems, Maven, NPM, Nuget, Pypi<\/p>\n<p>M\u00edt specializovanou v\u00fdzkumnou skupinu<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Pr\u00e1ce v uzav\u0159en\u00e9m obvodu<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Pou\u017e\u00edv\u00e1n\u00ed extern\u00edch datab\u00e1z\u00ed<br \/>\n+ Uzav\u0159en\u00e1 datab\u00e1ze Sonatype<br \/>\n+ Sonatype OSS, NPM ve\u0159ejn\u00ed poradci<br \/>\n+ Sonatype OSS, NPM ve\u0159ejn\u00ed poradci, RetireJS, VulnDB, podpora vlastn\u00ed datab\u00e1ze zranitelnost\u00ed<\/p>\n<p>Mo\u017enost filtrovat komponenty s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem p\u0159i pokusu o nahr\u00e1n\u00ed do v\u00fdvojov\u00e9ho obvodu podle nakonfigurovan\u00fdch politik<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Doporu\u010den\u00ed pro opravy zranitelnost\u00ed, p\u0159\u00edtomnost odkaz\u016f na opravy<br \/>\n+<br \/>\n+- (z\u00e1vis\u00ed na popisu v ve\u0159ejn\u00fdch datab\u00e1z\u00edch)<br \/>\n+- (z\u00e1vis\u00ed na popisu v ve\u0159ejn\u00fdch datab\u00e1z\u00edch)<\/p>\n<p>Hodnocen\u00ed zji\u0161t\u011bn\u00fdch zranitelnost\u00ed podle z\u00e1va\u017enosti<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Role model p\u0159\u00edstupu<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>Podpora p\u0159\u00edkazov\u00e9ho \u0159\u00e1dku CLI<br \/>\n+<br \/>\n+<br \/>\n+- (pouze pro CycloneDX)<\/p>\n<p>V\u00fdb\u011br \/ t\u0159\u00edd\u011bn\u00ed zranitelnost\u00ed podle stanoven\u00fdch krit\u00e9ri\u00ed<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>Dashboard stavu aplikac\u00ed<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>Generov\u00e1n\u00ed zpr\u00e1v ve form\u00e1tu PDF<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Generov\u00e1n\u00ed zpr\u00e1v ve form\u00e1tu JSONCSV<br \/>\n+<br \/>\n+<br \/>\n&#8212;<\/p>\n<p>Podpora \u010desk\u00e9ho jazyka<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>\nIntegra\u010dn\u00ed mo\u017enosti<\/p>\n<p>Integrace<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Integrace s LDAP\/Active Directory<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<p>Integrace s n\u00e1strojem pro kontinu\u00e1ln\u00ed integraci (continuous integration) Bamboo<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Integrace s n\u00e1strojem pro kontinu\u00e1ln\u00ed integraci (continuous integration) TeamCity<br \/>\n+<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Integrace s n\u00e1strojem pro kontinu\u00e1ln\u00ed integraci (continuous integration) GitLab<br \/>\n+<br \/>\n+- (ve form\u011b pluginu pro GitLab)<br \/>\n+<\/p>\n<p>Integrace s n\u00e1strojem pro kontinu\u00e1ln\u00ed integraci (continuous integration) Jenkins<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Dostupnost plugin\u016f k IDE<br \/>\n+ IntelliJ, Eclipse, Visual Studio<br \/>\n&#8212;<br \/>\n&#8212;<\/p>\n<p>Podpora p\u0159izp\u016fsoben\u00e9 integrace p\u0159es webov\u00e9 slu\u017eby (API) n\u00e1stroje<br \/>\n+<br \/>\n&#8212;<br \/>\n+<\/p>\n<h3>Dependency Check<\/h3>\n<p><\/p>\n<h4>Prvn\u00ed spu\u0161t\u011bn\u00ed<\/h4>\n<p>\nSpust\u00edme Dependency Check proti \u00famysln\u011b zraniteln\u00e9mu aplikaci <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/appsecco\/dvja\">DVJA<\/a><\/noindex>.<\/p>\n<p>Pro toto vyu\u017eijeme <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jeremylong\/DependencyCheck\">Dependency Check Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.owasp:dependency-check-maven:check<\/code><\/pre>\n<p>\nV\u00fdsledkem v adres\u00e1\u0159i target se objev\u00ed dependency-check-report.html.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/d5b9fe5a8eb68569387dd0bfd38af459.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOtev\u0159eme soubor. Po shrnuj\u00edc\u00ed informaci o celkov\u00e9m po\u010dtu zranitelnost\u00ed m\u016f\u017eeme vid\u011bt informace o zranitelnostech s vysokou \u00farovn\u00ed z\u00e1va\u017enosti a d\u016fv\u011bryhodnosti s uveden\u00edm na bal\u00ed\u010dek, CPE, \u010d\u00edslo CVE.<\/p>\n<p>N\u00e1sleduje podrobn\u011bj\u0161\u00ed informace, zejm\u00e9na to, na z\u00e1klad\u011b \u010deho bylo rozhodnut\u00ed p\u0159ijato (evidence), tedy jak\u00fdsi BOM.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/53dd89b0ff20c4c51aaf7412399e7fd9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nD\u00e1le n\u00e1sleduje CPE, PURL a popis CVE. Doporu\u010den\u00ed k n\u00e1prav\u011b ostatn\u011b nebyla poskytnuta z d\u016fvodu jejich absence v datab\u00e1zi NVD.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/ba2021aa8b6bf175383298b2c2a71670.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro systematick\u00e9 prohl\u00ed\u017een\u00ed v\u00fdsledk\u016f skenov\u00e1n\u00ed lze nastavit Nginx s minim\u00e1ln\u00edmi nastaven\u00edmi, nebo odes\u00edlat zji\u0161t\u011bn\u00e9 defekty do syst\u00e9mu pro spr\u00e1vu defekt\u016f, kter\u00e9 podporuj\u00ed konektory pro Dependency Check. Nap\u0159\u00edklad Defect Dojo. <\/p>\n<h3>Dependency Track<\/h3>\n<p><\/p>\n<h4>Instalace<\/h4>\n<p>\nDependency Track je na druh\u00e9 stran\u011b webov\u00e1 platforma s grafick\u00fdm zobrazen\u00edm, proto akutn\u00ed probl\u00e9m ukl\u00e1d\u00e1n\u00ed defekt\u016f ve t\u0159et\u00edm \u0159e\u0161en\u00ed zde nestoj\u00ed. <br \/>\nPro instalaci existuj\u00ed n\u00e1sleduj\u00edc\u00ed podporovan\u00e9 sc\u00e9n\u00e1\u0159e: Docker, WAR, Executable WAR. <\/p>\n<h4>Prvn\u00ed spu\u0161t\u011bn\u00ed<\/h4>\n<p>\nP\u0159ejdeme na URL spu\u0161t\u011bn\u00e9 slu\u017eby. P\u0159ihl\u00e1s\u00edme se p\u0159es admin\/admin, zm\u011bn\u00edme u\u017eivatelsk\u00e9 jm\u00e9no a heslo, pot\u00e9 se dostaneme na Dashboard. Dal\u0161\u00ed krok, kter\u00fd ud\u011bl\u00e1me \u2014 vytvo\u0159\u00edme projekt pro testovac\u00ed aplikaci na Java v<i> Home\/Projects \u2192 Vytvo\u0159it Projekt <\/i>. Jako p\u0159\u00edklad vezmeme DVJA.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/338aaa1c9ca0ac99f2e857f8ce001a02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJeliko\u017e Dependency Track m\u016f\u017ee p\u0159ij\u00edmat pouze BOM jako vstupn\u00ed data, je nutn\u00e9 tento BOM z\u00edskat. Vyu\u017eijeme <noindex><a rel=\"nofollow\" href=\"https:\/\/github.coam\/CycloneDX\/cyclonedx-maven-plugin\">CycloneDX Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom<\/code><\/pre>\n<p>\nZ\u00edsk\u00e1me bom.xml a nahrajeme soubor v vytvo\u0159en\u00e9m projektu <i>DVJA \u2192 Z\u00e1vislosti \u2192 Nahr\u00e1t BOM<\/i>.<\/p>\n<p>P\u0159ejdeme do Administrace \u2192 Analytici. Uv\u011bdomujeme si, \u017ee m\u00e1me zapnut pouze Intern\u00ed analytik, kter\u00fd zahrnuje NVD. P\u0159ipoj\u00edme tak\u00e9 Sonatype OSS Index.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/3879a9a3d5f227d9740a984e7b1b91b2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00edmto z\u00edsk\u00e1me n\u00e1sleduj\u00edc\u00ed p\u0159ehled pro n\u00e1\u0161 projekt:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/004f2ab3383acb87e3d5e8c0fba1f3c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTak\u00e9 v seznamu lze nal\u00e9zt jednu zranitelnost vztahuj\u00edc\u00ed se k Sonatype OSS:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/e459f08218f890b46fb4050c30da63c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHlavn\u00edm zklam\u00e1n\u00edm bylo, \u017ee Dependency Track ji\u017e nep\u0159ij\u00edm\u00e1 XML zpr\u00e1vy Dependency Check. Posledn\u00ed podporovan\u00e9 verze integrace s Dependency Check byly 1.0.0 \u2013 4.0.2, zat\u00edmco jsem testoval 5.3.2.<\/p>\n<p>Tady <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/d2WMONyBbTw\">video<\/a><\/noindex> (a <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/IPWPISSk5rc\">tady je<\/a><\/noindex>), kdy\u017e to je\u0161t\u011b bylo mo\u017en\u00e9. <\/p>\n<h3>Nexus IQ <\/h3>\n<p><\/p>\n<h4>Prvn\u00ed spu\u0161t\u011bn\u00ed<\/h4>\n<p>\nInstalace Nexus IQ prob\u00edh\u00e1 z archiv\u016f na <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/iqserver\/installing\/iq-server-installation\">dokumentaci<\/a><\/noindex>, ale pro tyto \u00fa\u010dely jsme si sestavili obraz Docker.<\/p>\n<p>Po p\u0159ihl\u00e1\u0161en\u00ed do konzole je t\u0159eba vytvo\u0159it Organizaci a Aplikaci.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/4c6df91bad77e87ea066ff3514a03644.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/d8580ba46852e4d97625a22e215c21d3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/d99ce4e47218001fd1a76722e2633bea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nJak vid\u00edte, nastaven\u00ed v p\u0159\u00edpad\u011b IQ je pon\u011bkud slo\u017eit\u011bj\u0161\u00ed, proto\u017ee mus\u00edme tak\u00e9 vytvo\u0159it politiky aplikovateln\u00e9 pro r\u016fzn\u00e9 \u201ef\u00e1ze\u201c (dev, build, stage, release). To je nutn\u00e9 k blokov\u00e1n\u00ed zraniteln\u00fdch komponent p\u0159i postupu v pipeline bl\u00ed\u017e k produkci, nebo blokovat jakmile se dostanou do Nexus Repo p\u0159i stahov\u00e1n\u00ed v\u00fdvoj\u00e1\u0159i.<\/p>\n<p>Abychom si uv\u011bdomili rozd\u00edl mezi open source a enterprise, provedeme stejn\u00e9 skenov\u00e1n\u00ed prost\u0159ednictv\u00edm Nexus IQ analogicky prost\u0159ednictv\u00edm <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/integrations\/sonatype-clm-for-maven\">Maven plugin<\/a><\/noindex>, p\u0159i\u010dem\u017e nejprve vytvo\u0159\u00edme testovac\u00ed aplikaci v rozhran\u00ed NexusIQ <code>dvja-test-and-compare<\/code>:<\/p>\n<pre><code class=\"plaintext\">mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.applicationId=dvja-test-and-compare -Dclm.serverUrl= -Dclm.username= -Dclm.password=\n<\/code><\/pre>\n<p>\nP\u0159ejdeme na URL ke vygenerovan\u00e9 zpr\u00e1v\u011b v webov\u00e9m rozhran\u00ed IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/f81f998037ba53ef62298955077d044d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZde lze vid\u011bt v\u0161echna poru\u0161en\u00ed politiky s ozna\u010den\u00edm r\u016fzn\u00e9 \u00farovn\u011b z\u00e1va\u017enosti (od Info po Security Critical). P\u00edsmeno D vedle komponenty znamen\u00e1, \u017ee komponenta je p\u0159\u00edm\u00e1 z\u00e1vislost, a p\u00edsmeno T vedle komponenty znamen\u00e1, \u017ee komponenta je tranzitivn\u00ed z\u00e1vislost, tedy je tranzitivn\u00ed.<\/p>\n<p>Mimochodem, zpr\u00e1va <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/open-source-security\/\">State of Open Source Security Report 2020<\/a><\/noindex> od Snyku uv\u00e1d\u00ed, \u017ee v\u00edce ne\u017e 70 % zranitelnost\u00ed open source zji\u0161t\u011bn\u00fdch v Node.js, Java a Ruby se nach\u00e1z\u00ed v tranzitivn\u00edch z\u00e1vislostech.<\/p>\n<p>Pokud otev\u0159ete jedno z poru\u0161en\u00ed politiky Nexus IQ, uvid\u00edte popis komponenty a tak\u00e9 Version Graph, kter\u00fd ukazuje um\u00edst\u011bn\u00ed aktu\u00e1ln\u00ed verze na \u010dasov\u00e9 ose a tak\u00e9 v jak\u00e9m okam\u017eiku zranitelnost p\u0159est\u00e1v\u00e1 b\u00fdt zraniteln\u00e1. V\u00fd\u0161ka sv\u00ed\u010dek na grafu ukazuje popularitu pou\u017e\u00edv\u00e1n\u00ed t\u00e9to komponenty.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/d33968a5ce5904da6f50133f882521fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPokud p\u0159ejdete do sekce zranitelnost\u00ed a rozbal\u00edte CVE, m\u016f\u017eete si p\u0159e\u010d\u00edst popis t\u00e9to zranitelnosti, doporu\u010den\u00ed pro odstran\u011bn\u00ed a tak\u00e9 d\u016fvod, pro\u010d se tato komponenta dostala pod poru\u0161en\u00ed, tedy p\u0159\u00edtomnost t\u0159\u00eddy. <code>DiskFileitem.class<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/6d91b98a9a9a1a62264f1b4194f33ca4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/c9e580ad178a9c0307ed1e63d6dd244d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nShrneme pouze ty, kter\u00e9 se t\u00fdkaj\u00ed t\u0159et\u00edch komponent\u016f Java, a odstran\u00edme js komponenty. V z\u00e1vork\u00e1ch uvedeme po\u010det zranitelnost\u00ed, kter\u00e9 byly nalezeny mimo NVD.<\/p>\n<p><b>Celkem Nexus IQ: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 62<\/li>\n<li>Zraniteln\u00e9 z\u00e1vislosti: 16<\/li>\n<li>Nalezen\u00e9 zranitelnosti: 42 (8 sonatype db)<\/li>\n<\/ul>\n<p>\n<b>Celkem Dependency Check: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 47<\/li>\n<li>Zraniteln\u00e9 z\u00e1vislosti: 13<\/li>\n<li>Nalezen\u00e9 zranitelnosti: 91 (14 sonatype oss)<\/li>\n<\/ul>\n<p>\n<b>Celkem Dependency Track: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 59<\/li>\n<li>Zraniteln\u00e9 z\u00e1vislosti: 10<\/li>\n<li>Nalezen\u00e9 zranitelnosti: 51 (1 sonatype oss)<\/li>\n<\/ul>\n<p>\nDal\u0161\u00edm krokem bude analyzovat z\u00edskan\u00e9 v\u00fdsledky a zjistit, kter\u00e9 z t\u011bchto zranitelnost\u00ed jsou skute\u010dn\u00fdm defektem a kter\u00e9 jsou fale\u0161n\u00fdm poplachem.<\/p>\n<h3>Vylou\u010den\u00ed odpov\u011bdnosti<\/h3>\n<p>\nTato recenze nen\u00ed nevyvratitelnou pravdou. Autora nem\u011bla za c\u00edl vyzdvihnout jeden n\u00e1stroj nad ostatn\u00ed. Smyslem recenze bylo uk\u00e1zat mechanismy fungov\u00e1n\u00ed n\u00e1stroj\u016f SCA a zp\u016fsoby ov\u011b\u0159en\u00ed jejich v\u00fdsledk\u016f.<\/p>\n<h3>Porovn\u00e1n\u00ed v\u00fdsledk\u016f<\/h3>\n<p>\n<b>Podm\u00ednky:<\/b><\/p>\n<p><b>Fale\u0161n\u00fdm poplachem v souvislosti se zranitelnostmi t\u0159et\u00edch komponent\u016f je:<\/b><\/p>\n<ul>\n<li><b>Nesoulad CVE s identifikovanou komponentou<\/b><\/li>\n<li>Nap\u0159\u00edklad pokud je zranitelnost zji\u0161t\u011bna ve frameworku struts2 a n\u00e1stroj ukazuje na komponentu frameworku struts-tiles, ke kter\u00e9 se tato zranitelnost nevztahuje, pak jde o fale\u0161n\u00fd poplach.<\/li>\n<li><b>Nesoulad CVE s identifikovanou verz\u00ed komponenty<\/b><\/li>\n<li>Nap\u0159\u00edklad zranitelnost je v\u00e1z\u00e1na na verzi python &gt; 3.5 a n\u00e1stroj ozna\u010duje za zranitelnou verzi 2.7 - to je fale\u0161n\u00fd poplach, proto\u017ee zranitelnost se ve skute\u010dnosti t\u00fdk\u00e1 pouze v\u011btve produktu 3.x. <\/li>\n<li> <b>Duplicita CVE<\/b><\/li>\n<li>Nap\u0159\u00edklad pokud SCA uk\u00e1zal na CVE, kter\u00e9 umo\u017e\u0148uje realizovat RCE, a pot\u00e9 SCA ozna\u010duje pro tuto stejnou komponentu CVE, kter\u00e9 se vztahuje k produkt\u016fm Cisco, zasa\u017een\u00fdm touto RCE. V takov\u00e9m p\u0159\u00edpad\u011b p\u016fjde o fale\u0161n\u00fd poplach.<\/li>\n<li>Nap\u0159\u00edklad byla nalezena CVE v komponent\u011b spring-web, po \u010dem\u017e SCA ukazuje na tuto CVE v dal\u0161\u00edch komponent\u00e1ch frameworku Spring Framework, zat\u00edmco CVE nem\u00e1 \u017e\u00e1dn\u00fd vztah k jin\u00fdm komponent\u00e1m. V takov\u00e9m p\u0159\u00edpad\u011b bude v\u00fdsledkem false positive. <\/li>\n<\/ul>\n<p>\nP\u0159edm\u011btem v\u00fdzkumu byl vybr\u00e1n Open Source projekt DVJA. Ve v\u00fdzkumu byly zahrnuty pouze java komponenty (bez js).<\/p>\n<h3>Shrnuj\u00edc\u00ed v\u00fdsledky<\/h3>\n<p>\nP\u0159ejdeme p\u0159\u00edmo k v\u00fdsledk\u016fm manu\u00e1ln\u00edho revize identifikovan\u00fdch zranitelnost\u00ed. S podrobnou zpr\u00e1vou pro ka\u017edou CVE se m\u016f\u017eete sezn\u00e1mit v P\u0159\u00edloze. <\/p>\n<p><i>Shrnuj\u00edc\u00ed v\u00fdsledky v\u0161ech zranitelnost\u00ed:<\/i><\/p>\n<p>Parameter<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Celkov\u00fd po\u010det identifikovan\u00fdch zranitelnost\u00ed<br \/>\n42<br \/>\n91<br \/>\n51<\/p>\n<p>Nespr\u00e1vn\u011b identifikovan\u00e9 zranitelnosti (false positive)<br \/>\n2(4.76%)<br \/>\n62(68,13%)<br \/>\n29(56.86%)<\/p>\n<p>Nena\u0161ly se relevantn\u00ed zranitelnosti (false negative)<br \/>\n10<br \/>\n20<br \/>\n27<\/p>\n<p>\n<i>Shrnuj\u00edc\u00ed v\u00fdsledky podle komponent\u016f:<\/i><\/p>\n<p>Parameter<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Celkov\u00fd po\u010det identifikovan\u00fdch komponent\u016f<br \/>\n62<br \/>\n47<br \/>\n59<\/p>\n<p>Celkov\u00fd po\u010det zraniteln\u00fdch komponent\u016f<br \/>\n16<br \/>\n13<br \/>\n10<\/p>\n<p>Nespr\u00e1vn\u011b identifikovan\u00e9 zraniteln\u00e9 komponenty (false positive)<br \/>\n1<br \/>\n5<br \/>\n0<\/p>\n<p>Nespr\u00e1vn\u011b identifikovan\u00e9 zraniteln\u00e9 komponenty (false positive)<br \/>\n0<br \/>\n6<br \/>\n6<\/p>\n<p>\nVytvo\u0159\u00edme vizu\u00e1ln\u00ed grafiky, abychom posoudili pom\u011br false positive a false negative k celkov\u00e9mu po\u010dtu zranitelnost\u00ed. Na vodorovn\u00e9 ose jsou uvedeny komponenty a na svisl\u00e9 ose identifikovan\u00e9 zranitelnosti. <\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/967b8e168383299d4a1bf4065f1905ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/2e128ee59e551894c25e4c9e28997008.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/585d7bcef052ef24e4de6c7e1a4e7c0b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPro srovn\u00e1n\u00ed, podobn\u00fd v\u00fdzkum byl proveden t\u00fdmem Sonatype na testov\u00e1n\u00ed projektu z 1531 komponent\u016f pomoc\u00ed OWASP Dependency Check. Jak m\u016f\u017eeme vid\u011bt, pom\u011br \u0161umu k spr\u00e1vn\u00fdm aktivac\u00edm je podobn\u00fd na\u0161im v\u00fdsledk\u016fm.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/286c34b84f1400af0285b711b3fe87f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Zdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sonatype.com\/why-precision-matters-ebook\">www.sonatype.com\/why-precision-matters-ebook<\/a><\/noindex><\/i><\/p>\n<p>Pod\u00edv\u00e1me se na n\u011bkter\u00e9 CVE z v\u00fdsledk\u016f na\u0161eho skenov\u00e1n\u00ed, abychom pochopili p\u0159\u00ed\u010dinu t\u011bchto v\u00fdsledk\u016f.<\/p>\n<h3>V\u00edce informac\u00ed<\/h3>\n<p><\/p>\n<h4>\u010c.1<\/h4>\n<p>\nNejprve si probereme n\u011bkter\u00e9 zaj\u00edmav\u00e9 body Sonatype Nexus IQ.<\/p>\n<p>Nexus IQ ukazuje na probl\u00e9m s deserializac\u00ed s mo\u017enost\u00ed prov\u00e9st RCE v Spring Framework n\u011bkolikr\u00e1t. CVE-2016-1000027 v spring-web:3.0.5 poprv\u00e9, a CVE-2011-2894 v spring-context:3.0.5 a spring-core:3.0.5. Na prvn\u00ed pohled se zd\u00e1, \u017ee doch\u00e1z\u00ed k duplicaci zranitelnosti podle n\u011bkolika CVE. Nebo\u0165, pokud se pod\u00edv\u00e1te na CVE-2016-1000027 a CVE-2011-2894 v datab\u00e1zi NVD, vypad\u00e1 to jasn\u011b.<\/p>\n<p>Komponenta<br \/>\nZranitelnost<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>spring-core:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>\nPopis <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-2894\">CVE-2011-2894<\/a><\/noindex> z NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/31b403eca6d7541c766c9a560bfbe6b7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPopis <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-1000027\">CVE-2016-1000027<\/a><\/noindex> z NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/d5b54a6ac15070b12f013eaacd2878f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCVE-2011-2894 je sama o sob\u011b velmi zn\u00e1m\u00e1. Ve zpr\u00e1v\u011b <noindex><a rel=\"nofollow\" href=\"http:\/\/www.pwntester.com\/blog\/2013\/12\/16\/cve-2011-2894-deserialization-spring-rce\/\">White Source za rok 2011<\/a><\/noindex> tato CVE byla uzn\u00e1na jako jedna z nej\u010dast\u011bj\u0161\u00edch. Popis pro CVE-2016-100027 je obecn\u011b v NVD trochu nedosta\u010duj\u00edc\u00ed a plat\u00ed, \u017ee se zd\u00e1, \u017ee je pou\u017eiteln\u00e1 pouze pro Spring Framework 4.1.4. Pod\u00edvejme se na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">reference<\/a><\/noindex> a zde se to st\u00e1v\u00e1 v\u00edce nebo m\u00e9n\u011b jasn\u00e9. Z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">\u010dl\u00e1nku Tenable<\/a><\/noindex> porozum\u00edme, \u017ee krom\u011b zranitelnosti v <code>RemoteInvocationSerializingExporter<\/code> v CVE-2011-2894 je zranitelnost pozorov\u00e1na v <code>HttpInvokerServiceExporter<\/code>. O tom n\u00e1s informuje Nexus IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/a33f0853ce892d28eafafe2c8e7b2228.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNicm\u00e9n\u011b nic takov\u00e9ho nen\u00ed v NVD, co\u017e zp\u016fsobuje, \u017ee Dependency Check a Dependency Track dost\u00e1vaj\u00ed fale\u0161n\u011b negativn\u00ed v\u00fdsledky.<\/p>\n<p>Z popisu CVE-2011-2894 tak\u00e9 vypl\u00fdv\u00e1, \u017ee zranitelnost skute\u010dn\u011b existuje jak ve spring-context:3.0.5, tak ve spring-core:3.0.5. Potvrzen\u00ed toho lze nal\u00e9zt v \u010dl\u00e1nku od osob, kter\u00e9 tuto zranitelnost objevily.<\/p>\n<h4>\u010d. 2<\/h4>\n<p><\/p>\n<p>Komponenta<br \/>\nZranitelnost<br \/>\nV\u00fdsledek<\/p>\n<p>struts2-core:2.3.30<br \/>\nCVE-2016-4003<br \/>\nFALSE<\/p>\n<p>\nPokud se pod\u00edv\u00e1me na zranitelnost CVE-2016-4003, pochop\u00edme, \u017ee byla opravena ji\u017e ve verzi 2.3.28, p\u0159esto n\u00e1m Nexus IQ o n\u00ed informuje. V popisu zranitelnosti je pozn\u00e1mka:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principy fungov\u00e1n\u00ed a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st\" src=\"\/wp-content\/uploads\/2020\/08\/081f9006748083727e424b709a338d60.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTo znamen\u00e1, \u017ee zranitelnost existuje pouze ve spojen\u00ed se zastaralou verz\u00ed JRE, o \u010dem\u017e n\u00e1s cht\u011bli informovat. P\u0159esto to pova\u017eujeme za false positive, a\u010dkoliv ne tak v\u00e1\u017en\u00fd.<\/p>\n<h4>\u010d. 3<\/h4>\n<p><\/p>\n<p>Komponenta<br \/>\nZranitelnost<br \/>\nV\u00fdsledek<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\nTRUE<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-7672<br \/>\nFALSE<\/p>\n<p>\nPokud se pod\u00edv\u00e1me na popis CVE-2017-9804 a CVE-2017-7672, pochop\u00edme, \u017ee probl\u00e9m je v <code>URLValidator class<\/code>, p\u0159i\u010dem\u017e CVE-2017-9804 vych\u00e1z\u00ed z CVE-2017-7672. P\u0159\u00edtomnost druh\u00e9 zranitelnosti nenese \u017e\u00e1dnou u\u017eite\u010dnou z\u00e1t\u011b\u017e, krom\u011b toho, \u017ee jej\u00ed z\u00e1va\u017enost vzrostla na vysokou, tak\u017ee to lze pova\u017eovat za zbyte\u010dn\u00fd \u0161um.<\/p>\n<p>Celkov\u011b nebyly nalezeny \u017e\u00e1dn\u00e9 dal\u0161\u00ed fale\u0161n\u011b pozitivn\u00ed v\u00fdsledky pro Nexus IQ.<\/p>\n<h3>\u010d. 4<\/h3>\n<p>\nExistuje n\u011bkolik aspekt\u016f, kter\u00e9 vyzdvihuj\u00ed IQ na pozad\u00ed jin\u00fdch \u0159e\u0161en\u00ed.<\/p>\n<p>Komponenta<br \/>\nZranitelnost<br \/>\nV\u00fdsledek<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2020-5398<br \/>\nTRUE<\/p>\n<p>CVE v NVD uv\u00e1d\u00ed, \u017ee se vztahuje pouze na verze 5.2.x do 5.2.3, 5.1.x do 5.1.13 a verze 5.0.x do 5.0.16, p\u0159esto pokud se pod\u00edv\u00e1me na popis CVE v Nexus IQ, uvid\u00edme n\u00e1sleduj\u00edc\u00ed:<br \/>\n<i>Ozn\u00e1men\u00ed o deviaci poradenstv\u00ed: T\u00fdm bezpe\u010dnostn\u00edho v\u00fdzkumu Sonatype zjistil, \u017ee tato zranitelnost byla zaveden\u00e1 ve verzi 3.0.2.RELEASE a ne v 5.0.x, jak je uvedeno v poradenstv\u00ed.<\/i><\/p>\n<p>Po tomto n\u00e1sleduje PoC t\u00e9to zranitelnosti, kter\u00fd informuje, \u017ee existuje ve verzi 3.0.5.<\/p>\n<p>Fale\u0161n\u00fd negativ se pos\u00edl\u00e1 k Dependency Check a Dependency Track.<\/p>\n<h3>\u010d. 5<\/h3>\n<p>\nPod\u00edvejme se na fale\u0161n\u011b pozitivn\u00ed v\u00fdsledky pro Dependency Check a Dependency Track.<\/p>\n<p>Dependency Check se vyzna\u010duje t\u00edm, \u017ee odr\u00e1\u017e\u00ed CVE, kter\u00e9 se vztahuj\u00ed na cel\u00fd framework v NVD, na ty komponenty, kter\u00fdm se tato CVE net\u00fdkaj\u00ed. To se t\u00fdk\u00e1 CVE-2012-0394, CVE-2013-2115, CVE-2014-0114, CVE-2015-0899, CVE-2015-2992, CVE-2016-1181, CVE-2016-1182, kter\u00e9 Dependency Check \u201ep\u0159i\u0159adil\u201c k struts-taglib:1.3.8 a struts-tiles-1.3.8. Tyto komponenty nemaj\u00ed nic spole\u010dn\u00e9ho s t\u00edm, co je pops\u00e1no v CVE \u2014 zpracov\u00e1n\u00edm po\u017eadavk\u016f, validac\u00ed str\u00e1nek a tak d\u00e1le. To je d\u00e1no t\u00edm, \u017ee spole\u010dn\u00fdm prvkem mezi t\u011bmito CVE a komponentami je pouze framework, co\u017e je d\u016fvod, pro\u010d to Dependency Check pova\u017eoval za zranitelnost.<\/p>\n<p>Stejn\u00e1 situace je se spring-tx:3.0.5 a podobn\u00e1 situace plat\u00ed pro struts-core:1.3.8. Pro struts-core Dependency Check a Dependency Track na\u0161ly velk\u00e9 mno\u017estv\u00ed zranitelnost\u00ed, kter\u00e9 se ve skute\u010dnosti vztahuj\u00ed na struts2-core, kter\u00fd je v podstat\u011b samostatn\u00fdm r\u00e1mcem. V tomto p\u0159\u00edpad\u011b Nexus IQ spr\u00e1vn\u011b pochopil situaci a ve v\u0161ech vygenerovan\u00fdch CVE uvedl, \u017ee struts-core dos\u00e1hl konce \u017eivotnosti a je nutn\u00e9 p\u0159ej\u00edt na struts2-core.<\/p>\n<h3>\u010d. 6<\/h3>\n<p>\nV n\u011bkter\u00fdch situac\u00edch je nespravedliv\u00e9 vykl\u00e1dat jasnou chybu Dependency Check a Dependency Track. Konkr\u00e9tn\u011b CVE-2013-4152, CVE-2013-6429, CVE-2013-6430, CVE-2013-7315, CVE-2014-0054, CVE-2014-0225, CVE-2014-0225, kter\u00e9 Dependency Check a Dependency Track p\u0159i\u0159adili k spring-core:3.0.5, se ve skute\u010dnosti vztahuj\u00ed na spring-web:3.0.5. P\u0159itom \u010d\u00e1st z t\u011bchto CVE byla nalezena i v Nexus IQ, nicm\u00e9n\u011b IQ je spr\u00e1vn\u011b p\u0159i\u0159adil k jin\u00e9 komponent\u011b. To, \u017ee tyto zranitelnosti nebyly nalezeny ve spring-core, neznamen\u00e1, \u017ee v r\u00e1mci r\u00e1mce v\u016fbec nejsou, a open source n\u00e1stroje spr\u00e1vn\u011b upozornily na tyto zranitelnosti (jen se lehce p\u0159est\u0159elily). <\/p>\n<h3>Z\u00e1v\u011bry<\/h3>\n<p>\nJak vid\u00edme, ur\u010den\u00ed spr\u00e1vnosti zji\u0161t\u011bn\u00fdch zranitelnost\u00ed manu\u00e1ln\u00ed reviz\u00ed nenab\u00edz\u00ed jednozna\u010dn\u00e9 v\u00fdsledky, co\u017e vytv\u00e1\u0159\u00ed sporn\u00e9 momenty. V\u00fdsledky ukazuj\u00ed, \u017ee \u0159e\u0161en\u00ed Nexus IQ m\u00e1 nejni\u017e\u0161\u00ed m\u00edru fale\u0161n\u00fdch poplach\u016f a nejvy\u0161\u0161\u00ed p\u0159esnost. <\/p>\n<p>P\u0159edev\u0161\u00edm je to spojeno s t\u00edm, \u017ee t\u00fdm Sonatype roz\u0161\u00ed\u0159il popis ka\u017ed\u00e9 zranitelnosti CVE z NVD ve sv\u00fdch datab\u00e1z\u00edch, p\u0159i\u010dem\u017e uvedl s p\u0159esnost\u00ed na t\u0159\u00eddu nebo funkci zranitelnosti pro danou verzi komponenty a provedli dal\u0161\u00ed v\u00fdzkumy (nap\u0159\u00edklad zkontrolovali zranitelnosti u star\u0161\u00edch verz\u00ed softwaru). <\/p>\n<p>Nem\u00e9n\u011b d\u016fle\u017eit\u00fd vliv na v\u00fdsledky maj\u00ed i ty zranitelnosti, kter\u00e9 se nedostaly do NVD, ale p\u0159esto jsou v datab\u00e1zi Sonatype s ozna\u010den\u00edm SONATYPE. Podle zpr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Stav zranitelnost\u00ed open source bezpe\u010dnosti 2020<\/a><\/noindex> o 45 % zji\u0161t\u011bn\u00fdch zranitelnost\u00ed s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem nebylo hl\u00e1\u0161eno do NVD. Podle datab\u00e1ze WhiteSource pouze 29 % v\u0161ech zranitelnost\u00ed s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem, registrovan\u00fdch mimo NVD, nakonec publikov\u00e1no v NVD, proto je tak d\u016fle\u017eit\u00e9 hledat zranitelnosti tak\u00e9 v dal\u0161\u00edch zdroj\u00edch.<\/p>\n<p>V\u00fdsledkem je, \u017ee Dependency Check vyd\u00e1v\u00e1 velk\u00e9 mno\u017estv\u00ed \u0161umu, zat\u00edmco opom\u00edj\u00ed \u010d\u00e1st zraniteln\u00fdch komponent. Dependency Track generuje men\u0161\u00ed \u0161um a identifikuje velk\u00e9 mno\u017estv\u00ed komponent, co\u017e vizu\u00e1ln\u011b nevypad\u00e1 ru\u0161iv\u011b v webov\u00e9m rozhran\u00ed.<\/p>\n<p>Praxe ukazuje, \u017ee open source by m\u011bl b\u00fdt prvn\u00edm krokem k zral\u00e9mu DevSecOps. Prvn\u00edm krokem k integraci SCA do v\u00fdvoje by m\u011bly b\u00fdt procesy, konkr\u00e9tn\u011b diskuse s veden\u00edm a p\u0159\u00edbuzn\u00fdmi odd\u011blen\u00edmi o tom, jak by m\u011bly vypadat ide\u00e1ln\u00ed procesy v r\u00e1mci va\u0161\u00ed organizace. Mo\u017en\u00e1 zjist\u00edte, \u017ee pro va\u0161i organizaci v po\u010d\u00e1te\u010dn\u00edch f\u00e1z\u00edch posta\u010d\u00ed Dependency Check nebo Dependency Track, zat\u00edmco podnikov\u00e1 \u0159e\u0161en\u00ed p\u0159ijdou jako logick\u00e9 pokra\u010dov\u00e1n\u00ed v d\u016fsledku nar\u016fstaj\u00edc\u00ed slo\u017eitosti vyv\u00edjen\u00fdch aplikac\u00ed.<\/p>\n<p>                        <b class=\"spoiler_title\">P\u0159\u00edloha A. V\u00fdsledky vztahuj\u00edc\u00ed se k komponent\u016fm<\/b><br \/>\n                        <b>Zna\u010den\u00ed:<\/b><\/p>\n<ul>\n<li>High \u2014 zranitelnosti vysok\u00e9 a kritick\u00e9 \u00farovn\u011b v komponentu<\/li>\n<li>Medium \u2014 zranitelnosti st\u0159edn\u00ed \u00farovn\u011b kriti\u010dnosti v komponentu<\/li>\n<li>TRUE \u2014 Odpov\u00eddaj\u00edc\u00ed zranitelnost (True positive issue)<\/li>\n<li>FALSE \u2014 Fale\u0161n\u00e9 pozitivn\u00ed (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponenta<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nV\u00fdsledek<\/p>\n<p>dom4j: 1.6.1<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nHigh<br \/>\nHigh<br \/>\n&#8212;<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>commons-codec:1:10<br \/>\nMedium<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nHigh<br \/>\nkomponent nebyl nalezen<\/p>\n<p>TRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nHigh<br \/>\nkomponent nebyl nalezen<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nMedium<br \/>\nkomponent nebyl nalezen<br \/>\n&#8212;<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\nMedium<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nMedium<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n&#8212;<br \/>\nHigh<br \/>\n&#8212;<br \/>\nFALSE<\/p>\n<p>struts-core:1.3.8<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>xwork-core: 2.3.30<br \/>\nHigh<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nTRUE<\/p>\n<p>struts2-core: 2.3.30<br \/>\nHigh<br \/>\nHigh<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n&#8212;<br \/>\nHigh<br \/>\n&#8212;<br \/>\nFALSE<\/p>\n<p>struts-tiles-1.3.8<br \/>\n&#8212;<br \/>\nHigh<br \/>\n&#8212;<br \/>\nFALSE<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">P\u0159\u00edloha B. V\u00fdsledky vztahuj\u00edc\u00ed se k zranitelnostem<\/b><br \/>\n                        <b>Zna\u010den\u00ed:<\/b><\/p>\n<ul>\n<li>High \u2014 zranitelnosti vysok\u00e9 a kritick\u00e9 \u00farovn\u011b v komponentu<\/li>\n<li>Medium \u2014 zranitelnosti st\u0159edn\u00ed \u00farovn\u011b kriti\u010dnosti v komponentu<\/li>\n<li>TRUE \u2014 Odpov\u00eddaj\u00edc\u00ed zranitelnost (True positive issue)<\/li>\n<li>FALSE \u2014 Fale\u0161n\u00e9 pozitivn\u00ed (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponenta<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nZ\u00e1va\u017enost<br \/>\nV\u00fdsledek<br \/>\nKoment\u00e1\u0159<\/p>\n<p>dom4j: 1.6.1<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nCVE-2019-17571<br \/>\nCVE-2019-17571<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2020-9488<br \/>\n&#8212;<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>SONATYPE-2010-0053<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\n&#8212;<br \/>\nCVE-2015-6420<br \/>\nCVE-2015-6420<br \/>\nHigh<br \/>\nFALSE<br \/>\nDuplikuje RCE(OSSINDEX)<\/p>\n<p>&#8212;<br \/>\nCVE-2017-15708<br \/>\nCVE-2017-15708<br \/>\nHigh<br \/>\nFALSE<br \/>\nDuplikuje RCE(OSSINDEX)<\/p>\n<p>SONATYPE-2015-0002<br \/>\nRCE (OSSINDEX)<br \/>\nRCE(OSSINDEX)<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>SONATYPE-2014-0173<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2019-10086<br \/>\nCVE-2019-10086<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje pouze na verze 1.9.2+<\/p>\n<p>commons-codec:1:10<br \/>\nSONATYPE-2012-0050<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2019-2692<br \/>\nCVE-2019-2692<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2020-2875<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nStejn\u00e1 zranitelnost jako CVE-2019-2692, ale s dodatkem \u201e\u00fatoky mohou m\u00edt v\u00fdznamn\u00fd dopad na dal\u0161\u00ed produkty\u201c<\/p>\n<p>&#8212;<br \/>\nCVE-2017-15945<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNelze se vztahovat na mysql-connector-java<\/p>\n<p>&#8212;<br \/>\nCVE-2020-2933<br \/>\n&#8212;<br \/>\nLow<br \/>\nFALSE<br \/>\nDuplik\u00e1t k CVE-2020-2934<\/p>\n<p>CVE-2020-2934<br \/>\nCVE-2020-2934<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nCVE-2018-1270<br \/>\nkomponent nebyl nalezen<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2018-1257<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<br \/>\nkomponent nebyl nalezen<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2014-0225<br \/>\n&#8212;<br \/>\nCVE-2014-0225<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2011-2730<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\n&#8212;<br \/>\nCVE-2013-4152<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2018-1272<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2020-5398<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<br \/>\nUk\u00e1zkov\u00fd p\u0159\u00edklad v prosp\u011bch IQ: \u201eT\u00fdm pro v\u00fdzkum bezpe\u010dnosti Sonatype zjistil, \u017ee tato zranitelnost byla zavedena ve verzi 3.0.2.RELEASE a ne 5.0.x, jak je uvedeno v doporu\u010den\u00ed.\u201c<\/p>\n<p>CVE-2013-6429<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2014-0054<br \/>\n&#8212;<br \/>\nCVE-2014-0054<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2013-6430<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<br \/>\nkomponent nebyl nalezen<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\n&#8212;<br \/>\nCVE-2011-2730<br \/>\nCVE-2011-2730<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\n&#8212;<br \/>\nCVE-2013-4152<br \/>\nMedium<br \/>\nFALSE<br \/>\nDuplik\u00e1t t\u00e9to zranitelnosti v spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2013-4152<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2013-6429<br \/>\nCVE-2013-6429<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2013-6430<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2013-7315<br \/>\nCVE-2013-7315<br \/>\nMedium<br \/>\nFALSE<br \/>\nSPLIT z CVE-2013-4152. + Zranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0054<br \/>\nCVE-2014-0054<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0225<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web<\/p>\n<p>&#8212;<br \/>\n&#8212;<br \/>\nCVE-2014-0225<br \/>\nHigh<br \/>\nFALSE<br \/>\nDuplik\u00e1t t\u00e9to zranitelnosti v spring-web<\/p>\n<p>&#8212;<br \/>\nCVE-2014-1904<br \/>\nCVE-2014-1904<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web-mvc<\/p>\n<p>&#8212;<br \/>\nCVE-2014-3625<br \/>\nCVE-2014-3625<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web-mvc<\/p>\n<p>&#8212;<br \/>\nCVE-2016-9878<br \/>\nCVE-2016-9878<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web-mvc<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1270<br \/>\nCVE-2018-1270<br \/>\nHigh<br \/>\nFALSE<br \/>\nPro spring-expression \/ spring-messages<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1271<br \/>\nCVE-2018-1271<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se vztahuje k komponentu spring-web-mvc<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1272<br \/>\nCVE-2018-1272<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2014-3578<br \/>\nCVE-2014-3578 (OSSINDEX)<br \/>\nCVE-2014-3578<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>SONATYPE-2015-0327<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nSONATYPE-2016-0104<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n&#8212;<br \/>\nCVE-2011-2730<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2011-2894<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2013-4152<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2013-6429<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2013-6430<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2013-7315<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0054<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0225<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2014-1904<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2014-3625<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2016-9878<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1270<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1271<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1272<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost se nevztahuje na spring-tx<\/p>\n<p>struts-core:1.3.8<br \/>\n&#8212;<br \/>\nCVE-2011-5057 (OSSINDEX)<\/p>\n<p>Medium<br \/>\nFASLE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2012-0391 (OSSINDEX)<br \/>\nCVE-2012-0391<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0094 (OSSINDEX)<br \/>\nCVE-2014-0094<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0113 (OSSINDEX)<br \/>\nCVE-2014-0113<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>CVE-2016-1182<br \/>\n3VE-2016-1182<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\n&#8212;<br \/>\nCVE-2011-5057<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2012-0392 (OSSINDEX)<br \/>\nCVE-2012-0392<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2012-0393 (OSSINDEX)<br \/>\nCVE-2012-0393<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>CVE-2015-0899<br \/>\nCVE-2015-0899<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2012-0394<br \/>\nCVE-2012-0394<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2012-0838 (OSSINDEX)<br \/>\nCVE-2012-0838<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2013-1965 (OSSINDEX)<br \/>\nCVE-2013-1965<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2013-1966 (OSSINDEX)<br \/>\nCVE-2013-1966<br \/>\nHigh<br \/>\nFASLE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2013-2115<br \/>\nCVE-2013-2115<br \/>\nHigh<br \/>\nFASLE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2013-2134 (OSSINDEX)<br \/>\nCVE-2013-2134<br \/>\nHigh<br \/>\nFASLE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2013-2135 (OSSINDEX)<br \/>\nCVE-2013-2135<br \/>\nHigh<br \/>\nFASLE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>CVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2015-2992<br \/>\nCVE-2015-2992<br \/>\nMedium<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>&#8212;<br \/>\nCVE-2016-0785 (OSSINDEX)<br \/>\nCVE-2016-0785<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>CVE-2016-1181<br \/>\nCVE-2016-1181<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2016-4003 (OSSINDEX)<br \/>\nCVE-2016-4003<br \/>\nHigh<br \/>\nFALSE<br \/>\nZranitelnost v Struts 2<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>SONATYPE-2017-0173<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2017-7672<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nDuplik\u00e1t k CVE-2017-9804<\/p>\n<p>SONATYPE-2016-0127<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>struts2-core:2.3.30<br \/>\n&#8212;<br \/>\nCVE-2016-6795<br \/>\nCVE-2016-6795<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2017-9787<br \/>\nCVE-2017-9787<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2017-9791<br \/>\nCVE-2017-9791<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2017-9793<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nDuplik\u00e1t k CVE-2018-1327<\/p>\n<p>&#8212;<br \/>\nCVE-2017-9804<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>&#8212;<br \/>\nCVE-2017-9805<br \/>\nCVE-2017-9805<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2016-4003<br \/>\n&#8212;<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nPlat\u00ed pro Apache Struts 2.x a\u017e do 2.3.28, co\u017e je verze 2.3.30. Nicm\u00e9n\u011b, podle popisu, CVE plat\u00ed pro v\u0161echny verze Struts 2, pokud se pou\u017e\u00edv\u00e1 JRE 1.7 nebo star\u0161\u00ed. Z\u0159ejm\u011b se zde rozhodli pro jistotu, ale vypad\u00e1 to sp\u00ed\u0161e jako FALSE<\/p>\n<p>&#8212;<br \/>\nCVE-2018-1327<br \/>\nCVE-2018-1327<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nHigh<br \/>\nTRUE<br \/>\nTo je ta zranitelnost, kterou zneu\u017eili \u00fato\u010dn\u00edci v Equifaxu v roce 2017<\/p>\n<p>CVE-2017-12611<br \/>\nCVE-2017-12611<br \/>\n&#8212;<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>CVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nHigh<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n&#8212;<br \/>\nCVE-2012-0394<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nPro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2013-2115<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nPro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0114<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nPro commons-beanutils<\/p>\n<p>&#8212;<br \/>\nCVE-2015-0899<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro taglib<\/p>\n<p>&#8212;<br \/>\nCVE-2015-2992<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nPlat\u00ed pro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2016-1181<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro taglib<\/p>\n<p>&#8212;<br \/>\nCVE-2016-1182<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro taglib<\/p>\n<p>struts-tiles-1.3.8<br \/>\n&#8212;<br \/>\nCVE-2012-0394<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nPro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2013-2115<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nPro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2014-0114<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nPod commons-beanutils<\/p>\n<p>&#8212;<br \/>\nCVE-2015-0899<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro tiles<\/p>\n<p>&#8212;<br \/>\nCVE-2015-2992<br \/>\n&#8212;<br \/>\nMedium<br \/>\nFALSE<br \/>\nPro struts2-core<\/p>\n<p>&#8212;<br \/>\nCVE-2016-1181<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro taglib<\/p>\n<p>&#8212;<br \/>\nCVE-2016-1182<br \/>\n&#8212;<br \/>\nHigh<br \/>\nFALSE<br \/>\nNen\u00ed relevantn\u00ed pro taglib<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516660\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b. Software Composition Analysis \u2014 SCA) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0440\u0430\u0441\u0442\u0435\u0442 \u043f\u043e \u043c\u0435\u0440\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u044b\u0445 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 open source \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Synopsys, Sonatype, Snyk, White Source. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 The State of Open Source Security Vulnerabilities 2020 \u0447\u0438\u0441\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 open source \u0432 2019 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e\u0447\u0442\u0438 \u0432 1.5 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92520,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92519","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47DevSecOps: principy pr\u00e1ce a srovn\u00e1n\u00ed SCA. Prvn\u00ed \u010d\u00e1st | ProHoster","description":"V\u00fdznam anal\u00fdzy t\u0159et\u00edch stran softwaru (en.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-28T05:42:26+00:00","article:modified_time":"2020-08-28T05:42:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92519","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:06:40","updated":"2022-10-01 01:38:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=92519"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/92519\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/92520"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=92519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=92519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=92519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}