{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>Importan\u021ba analizei componentelor software de ter\u021b\u0103 parte (eng. Software Composition Analysis \u2014 SCA) \u00een procesul de dezvoltare cre\u0219te odat\u0103 cu publicarea anual\u0103 a rapoartelor privind vulnerabilit\u0103\u021bile bibliotecilor open source, publicate de companiile Synopsys, Sonatype, Snyk, White Source. Potrivit raportului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Starea vulnerabilit\u0103\u021bilor de securitate \u00een Open Source 2020<\/a><\/noindex> num\u0103rul de vulnerabilit\u0103\u021bi detectate \u00een open source \u00een 2019 a crescut cu aproape 1.5 ori comparativ cu anul precedent, \u00een timp ce componentele cu cod deschis sunt utilizate \u00een 60% p\u00e2n\u0103 la 80% din proiecte. Dac\u0103 ne raport\u0103m la opiniile independente, procesele SCA sunt o practic\u0103 distinct\u0103 \u00een OWASP SAMM \u0219i BSIMM ca indicator de maturitate, iar \u00een prima jum\u0103tate a anului 2020, OWASP a lansat un nou standard OWASP Software Component Verification Standard (SCVS), care ofer\u0103 bune practici pentru verificarea componentelor de ter\u021b\u0103 parte \u00een lan\u021bul de furnizare a software-ului.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/2a82121d42f9d317f3862a2d7869fdd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nUnul dintre cele mai ilustrative cazuri <noindex><a rel=\"nofollow\" href=\"https:\/\/xakep.ru\/2017\/09\/14\/equifax-dejstvitelno-vzlomali-cherez-bag-v-apache-struts-no-uyazvimost-okazalas-staroj\/\">a avut loc<\/a><\/noindex> cu compania Equifax \u00een mai 2017. Hackerii necunoscu\u021bi au ob\u021binut informa\u021bii despre 143 de milioane de americani, inclusiv nume complete, adrese, numere de asigurare social\u0103 \u0219i permise de conducere. \u00cen 209.000 de cazuri, documentele con\u021bineau de asemenea informa\u021bii despre cardurile bancare ale victimelor. Aceast\u0103 scurgere de date a avut loc \u00een urma exploat\u0103rii unei vulnerabilit\u0103\u021bi critice \u00een Apache Struts 2 (CVE-2017-5638), de\u0219i un patch fusese lansat \u00een martie 2017. Compania a avut dou\u0103 luni pentru a implementa actualizarea, dar nimeni nu s-a ocupat de aceasta.<\/p>\n<p>\u00cen acest articol se va discuta alegerea instrumentului pentru realizarea SCA din perspectiva calit\u0103\u021bii rezultatelor analizei. De asemenea, va fi prezentat un comparativ func\u021bional al instrumentelor. Procesul de integrare \u00een CI\/CD \u0219i posibilit\u0103\u021bile de integrare vor fi l\u0103sate pentru publica\u021bii viitoare. O list\u0103 extins\u0103 de instrumente a fost prezentat\u0103 de OWASP <noindex><a rel=\"nofollow\" href=\"https:\/\/owasp.org\/www-community\/Component_Analysis\">pe site-ul s\u0103u<\/a><\/noindex>, dar \u00een cadrul acestui rezumat ne vom referi doar la cel mai popular instrument open source Dependency Check, la platforma open source ceva mai pu\u021bin cunoscut\u0103 Dependency Track \u0219i la solu\u021bia Enterprise Sonatype Nexus IQ. De asemenea, vom analiza modul \u00een care func\u021bioneaz\u0103 aceste solu\u021bii \u0219i vom compara rezultatele ob\u021binute \u00een ceea ce prive\u0219te alertele false.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/0580758082abd9950aa9c483d546f1ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Principiul de func\u021bionare<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/jeremylong.github.io\/DependencyCheck\/\">Dependency Check<\/a><\/noindex> \u2014 este un utilitar (CLI, maven, modul jenkins, ant) care analizeaz\u0103 fi\u0219ierele proiectului, colecteaz\u0103 fragmente de informa\u021bii despre dependen\u021be (numele pachetului, groupid, titlul specifica\u021biei, versiune\u2026), construie\u0219te un \u0219ir CPE \u2014 (Common Platform Enumeration), Package URL (PURL) \u0219i identific\u0103 pentru CPE\/PURL vulnerabilit\u0103\u021bi din baze de date (NVD, Sonatype OSS Index, NPM Audit API\u2026), dup\u0103 care genereaz\u0103 un raport temporar \u00een format HTML, JSON, XML\u2026<\/p>\n<p>S\u0103 examin\u0103m cum arat\u0103 CPE:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Part:<\/b> Indica\u021bie privind faptul c\u0103 componenta apar\u021bine aplica\u021biei (a), sistemului de operare (o), hardware-ului (h) (punct obligatoriu)<\/li>\n<li><b>Vendor:<\/b> Numele produc\u0103torului produsului (punct obligatoriu)<\/li>\n<li><b>Product:<\/b> Numele produsului (punct obligatoriu)<\/li>\n<li><b>Version:<\/b> Versiunea componentei (punct \u00eenvechit)<\/li>\n<li><b>Actualizare:<\/b> Actualizarea pachetului<\/li>\n<li><b>Edition:<\/b> Versiunea mo\u0219tenit\u0103 (punct \u00eenvechit)<\/li>\n<li><b>Language:<\/b> Limb\u0103, definit\u0103 \u00een RFC-5646<\/li>\n<li><b>SW Edition:<\/b> Versiunea software-ului<\/li>\n<li><b>Target SW:<\/b> Mediul software \u00een care func\u021bioneaz\u0103 produsul<\/li>\n<li><b>Target HW:<\/b> Mediul hardware \u00een care func\u021bioneaz\u0103 produsul<\/li>\n<li><b>Other:<\/b> Informa\u021bii despre furnizor sau produs<\/li>\n<\/ul>\n<p>\nUn exemplu de CPE arat\u0103 astfel:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*<\/code><\/pre>\n<p>\n\u0218irul indic\u0103 faptul c\u0103 CPE versiunea 2.3 descrie componenta aplica\u021biei de la produc\u0103torul <code>pivotal_software <\/code>cu numele <code>spring_framework<\/code> versiunea 3.0.0. Dac\u0103 deschidem vulnerabilitatea <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0225\">CVE-2014-0225<\/a><\/noindex> \u00een NVD, putem observa men\u021bionarea acestei CPE. Prima problem\u0103 la care ar trebui s\u0103 ne concentr\u0103m este c\u0103 CVE \u00een NVD, conform CPE, raporteaz\u0103 o problem\u0103 \u00een framework, nu \u00een o anumit\u0103 component\u0103. Asta \u00eenseamn\u0103 c\u0103, dac\u0103 dezvoltatorii sunt puternic lega\u021bi de framework, iar vulnerabilitatea identificat\u0103 nu se refer\u0103 la modulele pe care le folosesc, specialistului \u00een securitate \u00eei va fi necesar s\u0103 analizeze aceast\u0103 CVE \u0219i s\u0103 se g\u00e2ndeasc\u0103 la actualizare.<\/p>\n<p>Adresa URL este, de asemenea, utilizat\u0103 de instrumentele SCA. Formatul adresei URL a pachetului este urm\u0103torul:<\/p>\n<pre><code class=\"plaintext\">scheme:type\/namespace\/name@version?qualifiers#subpath<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Scheme: <\/b>Va fi \u00eentotdeauna 'pkg', indic\u00e2nd c\u0103 acesta este URL-ul pachetului (Element obligatoriu)<\/li>\n<li><b>Type:<\/b> \u00abTip\u00bb de pachet sau \u00abprotocol\u00bb de pachet, de exemplu maven, npm, nuget, gem, pypi etc. (punct obligatoriu)<\/li>\n<li><b>Namespace:<\/b> Un anumit prefix al numelui, cum ar fi identificatorul grupului Maven, proprietarul imaginii Docker, utilizator sau organiza\u021bie GitHub. Op\u021bional \u0219i depinde de tip.<\/li>\n<li><b>Name:<\/b> Numele pachetului (punct obligatoriu)<\/li>\n<li><b>Version:<\/b> Versiunea pachetului<\/li>\n<li><b>Qualifiers:<\/b> Date suplimentare de calificare pentru pachet, precum OS, arhitectur\u0103, distribu\u021bie etc. Op\u021bional \u0219i dependent de tip.<\/li>\n<li><b>Subpath:<\/b> Cale suplimentar\u0103 \u00een pachet \u00een raport cu r\u0103d\u0103cina pachetului<\/li>\n<\/ul>\n<p>\nDe exemplu:<\/p>\n<pre><code class=\"plaintext\">pkg:golang\/google.golang.org\/genproto#googleapis\/api\/annotations\npkg:maven\/org.apache.commons\/io@1.3.4\npkg:pypi\/django-package@1.11.1.dev1<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/dependencytrack.org\/\">Dependency Track<\/a><\/noindex> \u2014 platform\u0103 web on-premise care accept\u0103 Bill of Materials (BOM) preg\u0103tite <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/CycloneDX\">CycloneDX<\/a><\/noindex> \u0219i <noindex><a rel=\"nofollow\" href=\"https:\/\/spdx.org\/licenses\/\">SPDX<\/a><\/noindex>, adic\u0103 specifica\u021bii preg\u0103tite despre dependen\u021bele existente. Acesta este un fi\u0219ier XML care descrie dependen\u021bele \u2014 nume, hashes, URL pachet, editor, licen\u021b\u0103. Apoi, Dependency Track analizeaz\u0103 BOM-ul, compar\u0103 dependen\u021bele identificate cu CVE-uri din baza de date a vulnerabilit\u0103\u021bilor (NVD, Sonatype OSS Index ...), dup\u0103 care construie\u0219te grafice, calculeaz\u0103 metrici, actualiz\u00e2nd regulat informa\u021biile despre statutul vulnerabilit\u0103\u021bilor componentelor. <\/p>\n<p>Exemplu de cum poate ar\u0103ta un BOM \u00een format XML:<\/p>\n<pre><code class=\"xml\">Apache\n      org.apache.tomcat\n      tomcat-catalina\n      9.0.14\n      \n        3942447fac867ae5cdb3229b658f4d48\n        e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a\n        f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b\n        e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282\n      \n      \n        \n          Apache-2.0\n        \n      \n      pkg:maven\/org.apache.tomcat\/tomcat-catalina@9.0.14\n    \n      <!-- More components here --><\/code><\/pre>\n<p>\nBOM-ul poate fi folosit nu doar ca parametru de intrare pentru Dependency Track, ci \u0219i pentru inventarierea componentelor software \u00een lan\u021bul de aprovizionare, de exemplu, pentru a oferi clientului software. \u00cen 2014, a fost propus \u00een SUA chiar \u0219i un proiect de lege <noindex><a rel=\"nofollow\" href=\"https:\/\/www.congress.gov\/bill\/113th-congress\/house-bill\/5793\">\u201eCyber Supply Chain Management and Transparency Act of 2014\u201d<\/a><\/noindex>, care stipula c\u0103 la achizi\u021bia de software, orice institu\u021bie guvernamental\u0103 trebuie s\u0103 solicite BOM pentru a preveni utilizarea componentelor vulnerabile, \u00eens\u0103 actul nu a fost aplicat niciodat\u0103.<\/p>\n<p>Revenind la SCA, Dependency Track are integra\u021bii gata f\u0103cute cu platforme de notificare precum Slack, sisteme de management al vulnerabilit\u0103\u021bilor precum Kenna Security. De asemenea, merit\u0103 men\u021bionat c\u0103 Dependency Track identific\u0103 versiunile \u00eenvechite ale pachetelor \u0219i ofer\u0103 informa\u021bii despre licen\u021be (prin suportul pentru SPDX).<\/p>\n<p>Dac\u0103 vorbim despre calitatea SCA, atunci aici exist\u0103 o diferen\u021b\u0103 fundamental\u0103.<\/p>\n<p>Dependency Track nu prime\u0219te proiectul ca date de intrare, ci accept\u0103 BOM. Asta \u00eenseamn\u0103 c\u0103, dac\u0103 vrem s\u0103 verific\u0103m proiectul, mai \u00eent\u00e2i trebuie s\u0103 gener\u0103m bom.xml, de exemplu, cu ajutorul CycloneDX. Astfel, Dependency Track depinde direct de CycloneDX. \u00cen acela\u0219i timp, aceasta ofer\u0103 posibilitatea de personalizare. A\u0219a a scris echipa OZON <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ozonru\/cyclonedx-go\">modulul CycloneDX<\/a><\/noindex> pentru generarea fi\u0219ierelor BOM pentru proiectele \u00een Golang, cu scopul de a fi scanate ulterior prin Dependency Track.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/sonatype.ru\/#nexusiq\">Nexus IQ<\/a><\/noindex> este o solu\u021bie comercial\u0103 SCA de la Sonatype, care face parte din ecosistemul Sonatype, care include, de asemenea, Nexus Repository Manager. Nexus IQ poate accepta ca date de intrare at\u00e2t arhive war (pentru proiectele Java) prin interfa\u021ba web sau API, c\u00e2t \u0219i BOM, dac\u0103 organiza\u021bia dumneavoastr\u0103 nu a reu\u0219it s\u0103 tranzi\u021bia de la CycloneDX la noua solu\u021bie. Spre deosebire de solu\u021biile open source, IQ nu se limiteaz\u0103 doar la CP\/PURL pentru componenta identificat\u0103 \u0219i vulnerabilitatea corespunz\u0103toare din baza de date, ci ia \u00een considerare \u0219i cercet\u0103rile proprii, de exemplu, numele func\u021biei sau clasei vulnerabile. Mecanismele IQ vor fi discutate mai t\u00e2rziu \u00een analiza rezultatelor.<\/p>\n<p>S\u0103 tragem c\u00e2teva concluzii despre caracteristicile func\u021bionale, precum \u0219i s\u0103 examin\u0103m limbajele acceptate pentru analiz\u0103:<\/p>\n<p>Language<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Java<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>C\/C++<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>C#<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>.Net<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Erlang<br \/>\n\u2014<br \/>\n\u2014<br \/>\n+<\/p>\n<p>JavaScript (NodeJS)<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>PHP<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Python<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Ruby<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Perl<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Scala<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Objective C<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Swift<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>R<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Go<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>\nFunc\u021bionalit\u0103\u021bile<\/p>\n<p>Func\u021bionalit\u0103\u021bile<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Posibilitatea de a asigura verificarea componentelor utilizate \u00een codul surs\u0103 pentru conformitatea licen\u021bei<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Posibilitatea de a scana \u0219i analiza imaginile Docker pentru vulnerabilit\u0103\u021bi \u0219i conformitatea licen\u021bei<br \/>\n+ Integrare cu Clair<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Posibilitatea de a configura politica de securitate pentru utilizarea bibliotecilor open source<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Posibilitatea de a scana repositoare open source pentru a identifica componente vulnerabile<br \/>\n+ RubyGems, Maven, NPM, Nuget, Pypi, Conan, Bower, Conda, Go, p2, R, Yum, Helm, Docker, CocoaPods, Git LFS<br \/>\n\u2014<br \/>\n+ Hex, RubyGems, Maven, NPM, Nuget, Pypi<\/p>\n<p>Existenta unei echipe de cercetare specializat\u0103<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Func\u021bionare \u00eentr-un contur \u00eenchis<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Utilizarea bazelor de date externe<br \/>\n+ Baza de date \u00eenchis\u0103 Sonatype<br \/>\n+ Sonatype OSS, NPM Public Advisors<br \/>\n+ Sonatype OSS, NPM Public Advisors, RetireJS, VulnDB, suport pentru propria baz\u0103 de date de vulnerabilit\u0103\u021bi<\/p>\n<p>Posibilitatea de a filtra componentele open source \u00een timpul \u00eencerc\u0103rii de a le \u00eenc\u0103rca \u00een conturul de dezvoltare conform politicilor configurate<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Recomand\u0103ri pentru remedierea vulnerabilit\u0103\u021bilor, cu linkuri c\u0103tre solu\u021bii<br \/>\n+<br \/>\n+- (depinde de descrierea din bazele publice)<br \/>\n+- (depinde de descrierea din bazele publice)<\/p>\n<p>Clasificarea vulnerabilit\u0103\u021bilor g\u0103site \u00een func\u021bie de gravitate<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Modelul de acces pe roluri<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Suport pentru interfa\u021ba de linie de comand\u0103 CLI<br \/>\n+<br \/>\n+<br \/>\n+- (doar pentru CycloneDX)<\/p>\n<p>Filtrarea \/ sortarea vulnerabilit\u0103\u021bilor \u00een func\u021bie de criteriile definite<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Dashboard pentru starea aplica\u021biilor<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Generarea raportelor \u00een format PDF<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Generarea raportelor \u00een format JSONCSV<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Suport pentru limba rus\u0103<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>\nCapabilit\u0103\u021bi de integrare<\/p>\n<p>Integrare<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Integrare cu LDAP\/Active Directory<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Integrare cu sistemul de integrare continu\u0103 (continous integration) Bamboo<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integrare cu sistemul de integrare continu\u0103 (continous integration) TeamCity<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integrare cu sistemul de integrare continu\u0103 (continous integration) GitLab<br \/>\n+<br \/>\n+- (sub form\u0103 de plugin pentru GitLab)<br \/>\n+<\/p>\n<p>Integrare cu sistemul de integrare continu\u0103 (continous integration) Jenkins<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Disponibilitatea plugin-urilor pentru IDE<br \/>\n+ IntelliJ, Eclipse, Visual Studio<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Suport pentru integrarea personalizat\u0103 prin web-services (API) ale instrumentului<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<h3>Dependency Check<\/h3>\n<p><\/p>\n<h4>Prima lansare<\/h4>\n<p>\nVom rula Dependency Check pe o aplica\u021bie vulnerabil\u0103 inten\u021bionat <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/appsecco\/dvja\">DVJA<\/a><\/noindex>.<\/p>\n<p>Pentru aceasta, vom folosi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jeremylong\/DependencyCheck\">Plugin Maven pentru Dependency Check<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.owasp:dependency-check-maven:check<\/code><\/pre>\n<p>\nCa rezultat, \u00een directorul target va ap\u0103rea dependency-check-report.html.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/d5b9fe5a8eb68569387dd0bfd38af459.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVom deschide fi\u0219ierul. Dup\u0103 informa\u021biile sumare despre num\u0103rul total de vulnerabilit\u0103\u021bi, putem vedea informa\u021bii despre vulnerabilit\u0103\u021bile cu nivel mare de gravitate \u0219i \u00eencredere, indic\u00e2nd pachetul, CPE, num\u0103rul CVE.<\/p>\n<p>Urmeaz\u0103 informa\u021bii mai detaliate, \u00een special despre baza deciziei (evidence), adic\u0103 un fel de BOM.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/53dd89b0ff20c4c51aaf7412399e7fd9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nApoi apare CPE, PURL \u0219i descrierea CVE. Recomand\u0103rile pentru remedieri nu sunt incluse din cauza absen\u021bei lor \u00een baza NVD.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/ba2021aa8b6bf175383298b2c2a71670.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru a vizualiza sistematic rezultatele scan\u0103rii, se poate configura Nginx cu set\u0103ri minime sau trimite defectele ob\u021binute \u00een sistemul de gestionare a defectelor care suport\u0103 conectorii pentru Dependency Check. De exemplu, Defect Dojo. <\/p>\n<h3>Dependency Track<\/h3>\n<p><\/p>\n<h4>Instalare<\/h4>\n<p>\nDependency Track, la r\u00e2ndul s\u0103u, este o platform\u0103 web cu grafice vizibile, a\u0219a c\u0103 problematica stoc\u0103rii defectelor \u00een solu\u021bii externe nu se pune aici. <br \/>\nPentru instalare, exist\u0103 urm\u0103toarele scenarii acceptate: Docker, WAR, Executable WAR. <\/p>\n<h4>Prima lansare<\/h4>\n<p>\nAcces\u0103m URL-ul serviciului lansat. Ne log\u0103m cu admin\/admin, schimb\u0103m numele de utilizator \u0219i parola, dup\u0103 care ajungem la Dashboard. Urm\u0103torul lucru pe care \u00eel vom face este s\u0103 cre\u0103m un proiect pentru aplica\u021bia de testare \u00een Java \u00een<i> Home\/Projects \u2192 Create Project <\/i>. Ca exemplu, vom lua DVJA.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/338aaa1c9ca0ac99f2e857f8ce001a02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDeoarece Dependency Track poate accepta doar BOM ca date de intrare, este necesar s\u0103 ob\u021binem acest BOM. S\u0103 folosim <noindex><a rel=\"nofollow\" href=\"https:\/\/github.coam\/CycloneDX\/cyclonedx-maven-plugin\">CycloneDX Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom<\/code><\/pre>\n<p>\nVom ob\u021bine bom.xml \u0219i vom \u00eenc\u0103rca fi\u0219ierul \u00een proiectul creat <i>DVJA \u2192 Dependeencies \u2192 Upload BOM<\/i>.<\/p>\n<p>Acces\u0103m Administration \u2192 Analyzers. Observ\u0103m c\u0103 avem activat doar Internal Analyzer, care include NVD. Vom conecta \u0219i Sonatype OSS Index.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/3879a9a3d5f227d9740a984e7b1b91b2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAstfel, vom ob\u021bine urm\u0103toarea imagine pentru proiectul nostru:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/004f2ab3383acb87e3d5e8c0fba1f3c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDe asemenea, \u00een list\u0103 putem g\u0103si o vulnerabilitate aplicabil\u0103 la Sonatype OSS:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/e459f08218f890b46fb4050c30da63c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPrincipalul dezam\u0103gire a fost c\u0103 Dependency Track nu mai accept\u0103 rapoarte XML de la Dependency Check. Ultimele versiuni acceptate de integrare cu Dependency Check erau 1.0.0 \u2014 4.0.2, \u00een timp ce eu testam versiunea 5.3.2.<\/p>\n<p>Iat\u0103 <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/d2WMONyBbTw\">video<\/a><\/noindex> Volume Provisioning <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/IPWPISSk5rc\">iat\u0103<\/a><\/noindex>), c\u00e2nd acest lucru era \u00eenc\u0103 posibil. <\/p>\n<h3>Nexus IQ <\/h3>\n<p><\/p>\n<h4>Prima lansare<\/h4>\n<p>\nInstalarea Nexus IQ se face din arhive de <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/iqserver\/installing\/iq-server-installation\">documentation<\/a><\/noindex>, dar pentru aceste scopuri am creat o imagine Docker.<\/p>\n<p>Dup\u0103 ce ne conect\u0103m la consol\u0103, este necesar s\u0103 cre\u0103m o Organiza\u021bie \u0219i o Aplica\u021bie.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/4c6df91bad77e87ea066ff3514a03644.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/d8580ba46852e4d97625a22e215c21d3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/d99ce4e47218001fd1a76722e2633bea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nA\u0219a cum se poate observa, configurarea \u00een cazul IQ este ceva mai complex\u0103, deoarece trebuie s\u0103 cre\u0103m \u0219i politici aplicabile pentru diferite \u201eetape\u201d (dev, build, stage, release). Acest lucru este necesar pentru a bloca componentele vulnerabile pe m\u0103sur\u0103 ce avans\u0103m \u00een pipeline spre produc\u021bie, sau pentru a le bloca de \u00eendat\u0103 ce ajung \u00een Nexus Repo la desc\u0103rcarea de c\u0103tre dezvoltatori.<\/p>\n<p>Pentru a sim\u021bi diferen\u021ba dintre open source \u0219i enterprise, vom efectua aceea\u0219i scanare prin Nexus IQ similar cu <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/integrations\/sonatype-clm-for-maven\">plugin Maven<\/a><\/noindex>, dup\u0103 ce am creat anterior o aplica\u021bie de test \u00een interfa\u021ba NexusIQ <code>dvja-test-and-compare<\/code>:<\/p>\n<pre><code class=\"plaintext\">mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.applicationId=dvja-test-and-compare -Dclm.serverUrl= -Dclm.username= -Dclm.password=\n<\/code><\/pre>\n<p>\nAcces\u0103m URL-ul raportului generat \u00een interfa\u021ba web IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/f81f998037ba53ef62298955077d044d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAici putem vedea toate \u00eenc\u0103lc\u0103rile politicii, indic\u00e2nd diferite niveluri de severitate (de la Info la Security Critical). Litera D l\u00e2ng\u0103 component\u0103 \u00eenseamn\u0103 c\u0103 aceasta este o Direct Dependency, iar litera T l\u00e2ng\u0103 component\u0103 \u00eenseamn\u0103 c\u0103 aceasta este o Transitive Dependency, adic\u0103 este tranzitiv\u0103.<\/p>\n<p>Apropo, raportul <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/open-source-security\/\">State of Open Source Security Report 2020<\/a><\/noindex> de la Snyk indic\u0103 faptul c\u0103 peste 70% din vulnerabilit\u0103\u021bile open source descoperite \u00een Node.js, Java \u0219i Ruby se afl\u0103 \u00een dependen\u021be tranzitive.<\/p>\n<p>Dac\u0103 deschidem una dintre \u00eenc\u0103lc\u0103rile politicii Nexus IQ, putem vedea descrierea componentei, precum \u0219i Graph-ul Versiunii, care arat\u0103 loca\u021bia versiunii curente pe graficul temporal, precum \u0219i momentul \u00een care vulnerabilitatea \u00eenceteaz\u0103 s\u0103 mai fie vulnerabil\u0103. \u00cen\u0103l\u021bimea lum\u00e2n\u0103rilor de pe grafic indic\u0103 popularitatea utiliz\u0103rii acestei componente.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/d33968a5ce5904da6f50133f882521fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDac\u0103 mergem la sec\u021biunea vulnerabilit\u0103\u021bilor \u0219i desf\u0103\u0219ur\u0103m CVE, putem citi descrierea acestei vulnerabilit\u0103\u021bi, recomand\u0103rile de remediere, precum \u0219i motivul pentru care aceast\u0103 component\u0103 a fost inclus\u0103 sub \u00eenc\u0103lcare, adic\u0103 existen\u021ba clasei <code>DiskFileitem.class<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/6d91b98a9a9a1a62264f1b4194f33ca4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/c9e580ad178a9c0307ed1e63d6dd244d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nS\u0103 tragem concluzii doar cu privire la componentele externe Java, elimin\u00e2nd componentele js. \u00cen parantez\u0103 vom indica num\u0103rul de vulnerabilit\u0103\u021bi care au fost g\u0103site \u00een afara NVD.<\/p>\n<p><b>Total Nexus IQ: <\/b><\/p>\n<ul>\n<li>Dependen\u021be Scannate: 62<\/li>\n<li>Dependen\u021be Vulnerabile: 16<\/li>\n<li>Vulnerabilit\u0103\u021bi G\u0103site: 42 (8 baza de date sonatype)<\/li>\n<\/ul>\n<p>\n<b>Total Dependency Check: <\/b><\/p>\n<ul>\n<li>Dependen\u021be Scannate: 47<\/li>\n<li>Dependen\u021be Vulnerabile: 13<\/li>\n<li>Vulnerabilit\u0103\u021bi G\u0103site: 91 (14 sonatype oss)<\/li>\n<\/ul>\n<p>\n<b>Total Dependency Track: <\/b><\/p>\n<ul>\n<li>Dependen\u021be Scannate: 59<\/li>\n<li>Dependen\u021be Vulnerabile: 10<\/li>\n<li>Vulnerabilit\u0103\u021bi G\u0103site: 51 (1 sonatype oss)<\/li>\n<\/ul>\n<p>\nUrm\u0103torul pas este s\u0103 analiz\u0103m rezultatele ob\u021binute \u0219i s\u0103 ne d\u0103m seama ce dintre aceste vulnerabilit\u0103\u021bi reprezint\u0103 un defect real \u0219i ce este o alarm\u0103 fals\u0103.<\/p>\n<h3>Declinarea responsabilit\u0103\u021bii<\/h3>\n<p>\nAceast\u0103 revizuire nu este o adev\u0103r incontestabil. Autorul nu a avut ca obiectiv s\u0103 eviden\u021bieze un anumit instrument \u00een compara\u021bie cu altele. Scopul revizuirii a fost s\u0103 arate mecanismele de func\u021bionare ale instrumentelor SCA \u0219i modalit\u0103\u021bile de verificare a rezultatelor lor.<\/p>\n<h3>Compararea rezultatelor<\/h3>\n<p>\n<b>Condi\u021bii:<\/b><\/p>\n<p><b>O alarm\u0103 fals\u0103 \u00een ceea ce prive\u0219te vulnerabilit\u0103\u021bile componentelor externe este:<\/b><\/p>\n<ul>\n<li><b>Neconcordan\u021ba CVE cu componenta identificat\u0103<\/b><\/li>\n<li>De exemplu, dac\u0103 vulnerabilitatea este identificat\u0103 \u00een cadrul struts2 \u0219i instrumentul indic\u0103 o component\u0103 din cadrul struts-tiles, la care aceast\u0103 vulnerabilitate nu se aplic\u0103, atunci aceasta este o alarm\u0103 fals\u0103.<\/li>\n<li><b>Neconcordan\u021ba CVE cu versiunea identificat\u0103 a componentei<\/b><\/li>\n<li>De exemplu, vulnerabilitatea este legat\u0103 de versiunea python &gt; 3.5 \u0219i instrumentul marcheaz\u0103 versiunea 2.7 ca vulnerabil\u0103 - aceasta este o alarm\u0103 fals\u0103, deoarece, de fapt, vulnerabilitatea se aplic\u0103 doar ramurii de produs 3.x. <\/li>\n<li> <b>Dubla CVE<\/b><\/li>\n<li>De exemplu, dac\u0103 SCA a indicat o CVE care permite realizarea RCE, dup\u0103 care SCA indic\u0103 pentru aceea\u0219i component\u0103 o CVE aplicabil\u0103 produselor Cisco, expuse acestui RCE. \u00cen acest caz, va fi o alarm\u0103 fals\u0103.<\/li>\n<li>De exemplu, CVE a fost g\u0103sit\u0103 \u00een componenta spring-web, iar ulterior SCA indic\u0103 aceea\u0219i CVE \u00een alte componente ale framework-ului Spring Framework, \u00een timp ce CVE nu are leg\u0103tur\u0103 cu alte componente. \u00cen acest caz va fi un false positive. <\/li>\n<\/ul>\n<p>\nObiectul cercet\u0103rii a fost proiectul Open Source DVJA. \u00cen cercetare au fost incluse doar componente java (f\u0103r\u0103 js).<\/p>\n<h3>Rezultate sintetice<\/h3>\n<p>\nS\u0103 trecem direct la rezultatul revizuirii manuale a vulnerabilit\u0103\u021bilor identificate. Cu raportul complet pentru fiecare CVE poate fi consultat \u00een Anex\u0103. <\/p>\n<p><i>Rezultate sintetice pentru toate vulnerabilit\u0103\u021bile:<\/i><\/p>\n<p>Parametru<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Num\u0103r total de vulnerabilit\u0103\u021bi identificate<br \/>\n42<br \/>\n91<br \/>\n51<\/p>\n<p>Num\u0103r gre\u0219it de vulnerabilit\u0103\u021bi identificate (false positive)<br \/>\n2(4.76%)<br \/>\n62(68,13%)<br \/>\n29(56.86%)<\/p>\n<p>Nu au fost identificate vulnerabilit\u0103\u021bi relevante (false negative)<br \/>\n10<br \/>\n20<br \/>\n27<\/p>\n<p>\n<i>Rezultate sintetice pe componente:<\/i><\/p>\n<p>Parametru<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Num\u0103r total de componente identificate<br \/>\n62<br \/>\n47<br \/>\n59<\/p>\n<p>Num\u0103r total de componente vulnerabile<br \/>\n16<br \/>\n13<br \/>\n10<\/p>\n<p>Num\u0103r gre\u0219it de componente vulnerabile identificate (false positive)<br \/>\n1<br \/>\n5<br \/>\n0<\/p>\n<p>Num\u0103r gre\u0219it de componente vulnerabile identificate (false positive)<br \/>\n0<br \/>\n6<br \/>\n6<\/p>\n<p>\nVom construi grafice vizuale pentru a evalua raportul \u00eentre false positive \u0219i false negative fa\u021b\u0103 de num\u0103rul total de vulnerabilit\u0103\u021bi. Pe orizontal\u0103 sunt indicate componentele, iar pe vertical\u0103 vulnerabilit\u0103\u021bile identificate \u00een acestea. <\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/967b8e168383299d4a1bf4065f1905ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/2e128ee59e551894c25e4c9e28997008.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/585d7bcef052ef24e4de6c7e1a4e7c0b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPentru compara\u021bie, o cercetare similar\u0103 a fost realizat\u0103 de echipa Sonatype pe un proiect format din 1531 de componente folosind OWASP Dependency Check. A\u0219a cum putem observa, raportul \u00eentre zgomot \u0219i alarme corecte este comparabil cu rezultatele noastre.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/286c34b84f1400af0285b711b3fe87f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Sursa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sonatype.com\/why-precision-matters-ebook\">www.sonatype.com\/why-precision-matters-ebook<\/a><\/noindex><\/i><\/p>\n<p>S\u0103 examin\u0103m c\u00e2teva CVE din rezultatele scan\u0103rii noastre pentru a \u00een\u021belege cauza acestor rezultate.<\/p>\n<h3>Afl\u0103 mai multe<\/h3>\n<p><\/p>\n<h4>Nr. 1<\/h4>\n<p>\nS\u0103 discut\u0103m mai \u00eent\u00e2i despre c\u00e2teva puncte interesante din Sonatype Nexus IQ.<\/p>\n<p>Nexus IQ semnaleaz\u0103 o problem\u0103 de deserializare cu posibilitate de a executa RCE \u00een Spring Framework de mai multe ori. CVE-2016-1000027 \u00een spring-web:3.0.5 prima dat\u0103, \u0219i CVE-2011-2894 \u00een spring-context:3.0.5 \u0219i spring-core:3.0.5. La prima vedere, pare c\u0103 exist\u0103 o duplicare a vulnerabilit\u0103\u021bii pe mai multe CVE. Deoarece, dac\u0103 ne uit\u0103m la CVE-2016-1000027 \u0219i CVE-2011-2894 \u00een baza de date NVD, totul pare clar.<\/p>\n<p>Component\u0103<br \/>\nVulnerabilitatea<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>spring-core:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>\nDescriere <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-2894\">CVE-2011-2894<\/a><\/noindex> din NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/31b403eca6d7541c766c9a560bfbe6b7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDescriere <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-1000027\">CVE-2016-1000027<\/a><\/noindex> din NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/d5b54a6ac15070b12f013eaacd2878f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCVE-2011-2894 este destul de bine cunoscut\u0103. \u00cen raportul <noindex><a rel=\"nofollow\" href=\"http:\/\/www.pwntester.com\/blog\/2013\/12\/16\/cve-2011-2894-deserialization-spring-rce\/\">White Source din 2011<\/a><\/noindex> aceast\u0103 CVE a fost recunoscut\u0103 ca fiind una dintre cele mai frecvente. Descrierile pentru CVE-2016-100027 sunt \u00een general pu\u021bine \u00een NVD, iar aplicabilitatea acesteia pare a fi doar pentru Spring Framework 4.1.4. S\u0103 ne uit\u0103m la <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">reference<\/a><\/noindex> \u0219i aici devine mai mult sau mai pu\u021bin clar. Din <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">articolul Tenable<\/a><\/noindex> \u00een\u021belegem c\u0103 pe l\u00e2ng\u0103 vulnerabilitatea din <code>RemoteInvocationSerializingExporter<\/code> \u00een CVE-2011-2894, vulnerabilitatea se observ\u0103 \u00een <code>HttpInvokerServiceExporter<\/code>. Despre asta ne informeaz\u0103 Nexus IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/a33f0853ce892d28eafafe2c8e7b2228.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCu toate acestea, nu exist\u0103 nimic similar \u00een NVD, motiv pentru care Dependency Check \u0219i Dependency Track ob\u021bin false negative.<\/p>\n<p>De asemenea, din descrierea CVE-2011-2894 putem \u00een\u021belege c\u0103 vulnerabilitatea este cu adev\u0103rat prezent\u0103 at\u00e2t \u00een spring-context:3.0.5, c\u00e2t \u0219i \u00een spring-core:3.0.5. O confirmare a acestui lucru poate fi g\u0103sit\u0103 \u00een articolul celui care a descoperit aceast\u0103 vulnerabilitate.<\/p>\n<h4>Nr. 2<\/h4>\n<p><\/p>\n<p>Component\u0103<br \/>\nVulnerabilitatea<br \/>\nRezultatul<\/p>\n<p>struts2-core:2.3.30<br \/>\nCVE-2016-4003<br \/>\nFALSE<\/p>\n<p>\nDac\u0103 analiz\u0103m vulnerabilitatea CVE-2016-4003, vom \u00een\u021belege c\u0103 a fost corectat\u0103 \u00eenc\u0103 din versiunea 2.3.28, totu\u0219i Nexus IQ ne informeaz\u0103 despre aceasta. \u00cen descrierea vulnerabilit\u0103\u021bii exist\u0103 o not\u0103:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: principii de operare \u0219i compara\u021bia SCA. Partea \u00eent\u00e2i\" src=\"\/wp-content\/uploads\/2020\/08\/081f9006748083727e424b709a338d60.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAsta \u00eenseamn\u0103 c\u0103 vulnerabilitatea exist\u0103 doar \u00een asociere cu o versiune \u00eenvechit\u0103 de JRE, despre care am fost avertiza\u021bi. Totu\u0219i, consider\u0103m aceasta un False Positive, de\u0219i nu este cel mai grav.<\/p>\n<h4>Nr. 3<\/h4>\n<p><\/p>\n<p>Component\u0103<br \/>\nVulnerabilitatea<br \/>\nRezultatul<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\nTRUE<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-7672<br \/>\nFALSE<\/p>\n<p>\nDac\u0103 ne uit\u0103m la descrierea CVE-2017-9804 \u0219i CVE-2017-7672, vom \u00een\u021belege c\u0103 problema este \u00een <code>clasa URLValidator<\/code>, iar CVE-2017-9804 deriv\u0103 din CVE-2017-7672. Prezen\u021ba celei de-a doua vulnerabilit\u0103\u021bi nu aduce niciun beneficiu util, \u00een afar\u0103 de faptul c\u0103 severitatea ei a crescut la High, motiv pentru care putem considera aceasta un zgomot inutil.<\/p>\n<p>\u00cen general, nu au fost g\u0103site alte false positive pentru Nexus IQ.<\/p>\n<h3>Nr. 4<\/h3>\n<p>\nExist\u0103 c\u00e2teva aspecte care scot \u00een eviden\u021b\u0103 IQ \u00een compara\u021bie cu alte solu\u021bii.<\/p>\n<p>Component\u0103<br \/>\nVulnerabilitatea<br \/>\nRezultatul<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2020-5398<br \/>\nTRUE<\/p>\n<p>CVE \u00een NVD indic\u0103 faptul c\u0103 este aplicabil doar versiunilor 5.2.x p\u00e2n\u0103 la 5.2.3, 5.1.x p\u00e2n\u0103 la 5.1.13 \u0219i versiunilor 5.0.x p\u00e2n\u0103 la 5.0.16, totu\u0219i, dac\u0103 ne uit\u0103m la descrierea CVE \u00een Nexus IQ, vom vedea urm\u0103toarele:<br \/>\n<i>Advisory Deviation Notice: Echipa de cercetare \u00een securitate Sonatype a descoperit c\u0103 aceast\u0103 vulnerabilitate a fost introdus\u0103 \u00een versiunea 3.0.2.RELEASE \u0219i nu \u00een 5.0.x, a\u0219a cum este men\u021bionat \u00een notificare.<\/i><\/p>\n<p>Dup\u0103 aceasta urmeaz\u0103 PoC pentru aceast\u0103 vulnerabilitate, care indic\u0103 c\u0103 ea este prezent\u0103 \u00een versiunea 3.0.5.<\/p>\n<p>False negative este trimis c\u0103tre Dependency Check \u0219i Dependency Track.<\/p>\n<h3>Nr. 5<\/h3>\n<p>\nS\u0103 ne uit\u0103m la false positive pentru Dependency Check \u0219i Dependency Track.<\/p>\n<p>Dependency Check se eviden\u021biaz\u0103 prin faptul c\u0103 reflect\u0103 CVE-urile care se aplic\u0103 \u00eentregii framework din NVD, \u00een acele componente la care aceste CVE nu se aplic\u0103. Acest lucru se refer\u0103 la CVE-2012-0394, CVE-2013-2115, CVE-2014-0114, CVE-2015-0899, CVE-2015-2992, CVE-2016-1181, CVE-2016-1182, care au fost 'ata\u0219ate' la struts-taglib:1.3.8 \u0219i struts-tiles-1.3.8. Aceste componente nu au nicio leg\u0103tur\u0103 cu ceea ce este descris \u00een CVE \u2014 procesarea cererilor, validarea paginilor etc. Aceasta se datoreaz\u0103 faptului c\u0103 singurul lucru comun \u00eentre aceste CVE \u0219i componente este framework-ul, motiv pentru care Dependency Check a considerat aceasta o vulnerabilitate.<\/p>\n<p>Situa\u021bia este similar\u0103 cu spring-tx:3.0.5 \u0219i exist\u0103 situa\u021bii asem\u0103n\u0103toare cu struts-core:1.3.8. Pentru struts-core, Dependency Check \u0219i Dependency Track au g\u0103sit foarte multe vulnerabilit\u0103\u021bi care de fapt se aplic\u0103 lui struts2-core, care este \u00een esen\u021b\u0103 un cadru separat. \u00cen acest caz, Nexus IQ a \u00een\u021beles corect situa\u021bia \u0219i \u00een CVE-urile pe care le-a emis, a men\u021bionat c\u0103 struts-core a ajuns la sf\u00e2r\u0219itul vie\u021bii \u0219i trebuie s\u0103 se treac\u0103 la struts2-core.<\/p>\n<h3>\u21166<\/h3>\n<p>\n\u00cen unele situa\u021bii, a interpreta o eroare evident\u0103 a Dependency Check \u0219i Dependency Track este injust. \u00cen special CVE-2013-4152, CVE-2013-6429, CVE-2013-6430, CVE-2013-7315, CVE-2014-0054, CVE-2014-0225, care au fost atribuite de Dependency Check \u0219i Dependency Track lui spring-core:3.0.5, se refer\u0103 de fapt la spring-web:3.0.5. De asemenea, o parte dintre aceste CVE au fost g\u0103site \u0219i de Nexus IQ, cu toate acestea IQ le-a identificat corect la un alt component. Faptul c\u0103 aceste vulnerabilit\u0103\u021bi nu au fost g\u0103site \u00een spring-core nu \u00eenseamn\u0103 c\u0103 nu exist\u0103 \u00een cadru \u00een general, iar instrumentele open source au indicat corect aceste vulnerabilit\u0103\u021bi (doar c\u0103 au avut o u\u0219oar\u0103 necorelare). <\/p>\n<h3>Conclusions<\/h3>\n<p>\nA\u0219a cum putem vedea, determinarea validit\u0103\u021bii vulnerabilit\u0103\u021bilor identificate prin revizuirea manual\u0103 nu ofer\u0103 rezultate clare, ceea ce duce la momente disputate. Rezultatele arat\u0103 c\u0103 solu\u021bia Nexus IQ are cea mai mic\u0103 rat\u0103 de fals pozitive \u0219i cea mai mare precizie. <\/p>\n<p>\u00cen primul r\u00e2nd, acest lucru se datoreaz\u0103 faptului c\u0103 echipa Sonatype a extins descrierea fiec\u0103rei vulnerabilit\u0103\u021bi CVE din NVD \u00een bazele lor, specific\u00e2nd cu precizie p\u00e2n\u0103 la clas\u0103 sau func\u021bie vulnerabilitatea pentru fiecare versiune a componentelor, realiz\u00e2nd cercet\u0103ri suplimentare (de exemplu, verific\u00e2nd vulnerabilit\u0103\u021bile pe versiuni mai vechi de software). <\/p>\n<p>Un impact semnificativ asupra rezultatelor \u00eel au \u0219i acele vulnerabilit\u0103\u021bi care nu au fost incluse \u00een NVD, dar care sunt totu\u0219i prezente \u00een baza Sonatype cu marcajul SONATYPE. Conform raportului <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Starea vulnerabilit\u0103\u021bilor de securitate \u00een Open Source 2020<\/a><\/noindex> aproape 45% din vulnerabilit\u0103\u021bile descoperite cu surs\u0103 deschis\u0103 nu sunt raportate \u00een NVD. Conform bazei de date WhiteSource, doar 29% din toate vulnerabilit\u0103\u021bile cu surs\u0103 deschis\u0103 \u00eenregistrate \u00een afara NVD sunt \u00een cele din urm\u0103 publicate \u00een aceasta, de aceea este at\u00e2t de important s\u0103 c\u0103ut\u0103m vulnerabilit\u0103\u021bi \u0219i \u00een alte surse.<\/p>\n<p>Ca rezultat, Dependency Check produce o cantitate mare de zgomot, omor\u00e2nd o parte din componente vulnerabile. Dependency Track produce mai pu\u021bin zgomot \u0219i identific\u0103 un num\u0103r mare de componente, ceea ce nu deranjeaz\u0103 vizual \u00een interfa\u021ba web.<\/p>\n<p>Cu toate acestea, practica arat\u0103 c\u0103 open source ar trebui s\u0103 fie prima etap\u0103 pe calea c\u0103tre un DevSecOps matur. Primul lucru la care trebuie s\u0103 v\u0103 g\u00e2ndi\u021bi pentru a integra SCA \u00een dezvoltare este procesele, adic\u0103 reflec\u021biile al\u0103turi de conducere \u0219i departamentele aferente cu privire la cum ar trebui s\u0103 arate procesele ideale \u00een organiza\u021bia dumneavoastr\u0103. Poate c\u0103 pentru organiza\u021bia dumneavoastr\u0103, la \u00eenceput, Dependency Check sau Dependency Track vor acoperi toate nevoile de afaceri, \u00een timp ce solu\u021biile Enterprise vor fi o continuare logic\u0103 datorit\u0103 cre\u0219terii complexit\u0103\u021bii aplica\u021biilor dezvoltate.<\/p>\n<p>                        <b class=\"spoiler_title\">Anexa A. Rezultate pentru componente<\/b><br \/>\n                        <b>Semne conven\u021bionale:<\/b><\/p>\n<ul>\n<li>High \u2014 vulnerabilit\u0103\u021bi de nivel \u00eenalt \u0219i critic \u00een component\u0103<\/li>\n<li>Medium \u2014 vulnerabilit\u0103\u021bi de nivel mediu de criticitate \u00een component\u0103<\/li>\n<li>TRUE \u2014 vulnerabilitate identificat\u0103 corect (True positive issue)<\/li>\n<li>FALSE \u2014 fals pozitiv (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Component\u0103<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nRezultatul<\/p>\n<p>dom4j: 1.6.1<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nRidicat<br \/>\nRidicat<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>commons-codec:1:10<br \/>\nMedium<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nRidicat<br \/>\ncomponenta nu a fost g\u0103sit\u0103<\/p>\n<p>TRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nRidicat<br \/>\ncomponenta nu a fost g\u0103sit\u0103<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nMedium<br \/>\ncomponenta nu a fost g\u0103sit\u0103<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\nMedium<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nMedium<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nRidicat<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-core:1.3.8<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>xwork-core: 2.3.30<br \/>\nRidicat<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>struts2-core: 2.3.30<br \/>\nRidicat<br \/>\nRidicat<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nRidicat<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nRidicat<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Anexa B. Rezultate pentru vulnerabilit\u0103\u021bi<\/b><br \/>\n                        <b>Semne conven\u021bionale:<\/b><\/p>\n<ul>\n<li>High \u2014 vulnerabilit\u0103\u021bi de nivel \u00eenalt \u0219i critic \u00een component\u0103<\/li>\n<li>Medium \u2014 vulnerabilit\u0103\u021bi de nivel mediu de criticitate \u00een component\u0103<\/li>\n<li>TRUE \u2014 vulnerabilitate identificat\u0103 corect (True positive issue)<\/li>\n<li>FALSE \u2014 fals pozitiv (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Component\u0103<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nSeveritate<br \/>\nRezultatul<br \/>\nComentariu<\/p>\n<p>dom4j: 1.6.1<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nCVE-2019-17571<br \/>\nCVE-2019-17571<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-9488<br \/>\n\u2014<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>SONATYPE-2010-0053<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\n\u2014<br \/>\nCVE-2015-6420<br \/>\nCVE-2015-6420<br \/>\nRidicat<br \/>\nFALSE<br \/>\nSe duplic\u0103 RCE(OSSINDEX)<\/p>\n<p>\u2014<br \/>\nCVE-2017-15708<br \/>\nCVE-2017-15708<br \/>\nRidicat<br \/>\nFALSE<br \/>\nSe duplic\u0103 RCE(OSSINDEX)<\/p>\n<p>SONATYPE-2015-0002<br \/>\nRCE (OSSINDEX)<br \/>\nRCE(OSSINDEX)<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>SONATYPE-2014-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2019-10086<br \/>\nCVE-2019-10086<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 doar versiunilor 1.9.2+<\/p>\n<p>commons-codec:1:10<br \/>\nSONATYPE-2012-0050<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2019-2692<br \/>\nCVE-2019-2692<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-2875<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nAceea\u0219i vulnerabilitate ca \u0219i CVE-2019-2692, dar cu ad\u0103ugarea \u201eatacurile pot afecta semnificativ produse suplimentare\u201d<\/p>\n<p>\u2014<br \/>\nCVE-2017-15945<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 mysql-connector-java<\/p>\n<p>\u2014<br \/>\nCVE-2020-2933<br \/>\n\u2014<br \/>\nLow<br \/>\nFALSE<br \/>\nDuplicat al CVE-2020-2934<\/p>\n<p>CVE-2020-2934<br \/>\nCVE-2020-2934<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nCVE-2018-1270<br \/>\ncomponenta nu a fost g\u0103sit\u0103<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2018-1257<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<br \/>\ncomponenta nu a fost g\u0103sit\u0103<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2014-0225<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2011-2730<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2018-1272<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2020-5398<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<br \/>\nUn exemplu semnificativ \u00een favoarea IQ: \u201eEchipa de cercetare \u00een securitate Sonatype a descoperit c\u0103 aceast\u0103 vulnerabilitate a fost introdus\u0103 \u00een versiunea 3.0.2.RELEASE \u0219i nu 5.0.x a\u0219a cum se afirm\u0103 \u00een aviz.\u201d<\/p>\n<p>CVE-2013-6429<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2014-0054<br \/>\n\u2014<br \/>\nCVE-2014-0054<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>CVE-2013-6430<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<br \/>\ncomponenta nu a fost g\u0103sit\u0103<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\nCVE-2011-2730<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nMedium<br \/>\nFALSE<br \/>\nDuplicat al acelea\u0219i vulnerabilit\u0103\u021bi \u00een spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\nCVE-2013-6429<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\nCVE-2013-7315<br \/>\nMedium<br \/>\nFALSE<br \/>\nSPLIT din CVE-2013-4152. + Vulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\nCVE-2014-0054<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nRidicat<br \/>\nFALSE<br \/>\nDuplicat al acelea\u0219i vulnerabilit\u0103\u021bi \u00een spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\nCVE-2014-1904<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\nCVE-2014-3625<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\nCVE-2016-9878<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\nCVE-2018-1270<br \/>\nRidicat<br \/>\nFALSE<br \/>\nPentru spring-expression \/ spring-messages<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\nCVE-2018-1271<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea se aplic\u0103 componentului spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\nCVE-2018-1272<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2014-3578<br \/>\nCVE-2014-3578 (OSSINDEX)<br \/>\nCVE-2014-3578<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>SONATYPE-2015-0327<br \/>\n\u2014<br \/>\n\u2014<br \/>\nLow<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nSONATYPE-2016-0104<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2011-2894<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitatea nu se aplic\u0103 spring-tx<\/p>\n<p>struts-core:1.3.8<br \/>\n\u2014<br \/>\nCVE-2011-5057 (OSSINDEX)<\/p>\n<p>Medium<br \/>\nFASLE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0391 (OSSINDEX)<br \/>\nCVE-2012-0391<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0094 (OSSINDEX)<br \/>\nCVE-2014-0094<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0113 (OSSINDEX)<br \/>\nCVE-2014-0113<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>CVE-2016-1182<br \/>\n3VE-2016-1182<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2011-5057<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0392 (OSSINDEX)<br \/>\nCVE-2012-0392<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0393 (OSSINDEX)<br \/>\nCVE-2012-0393<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>CVE-2015-0899<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2012-0394<br \/>\nCVE-2012-0394<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0838 (OSSINDEX)<br \/>\nCVE-2012-0838<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1965 (OSSINDEX)<br \/>\nCVE-2013-1965<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1966 (OSSINDEX)<br \/>\nCVE-2013-1966<br \/>\nRidicat<br \/>\nFASLE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\nCVE-2013-2115<br \/>\nRidicat<br \/>\nFASLE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2134 (OSSINDEX)<br \/>\nCVE-2013-2134<br \/>\nRidicat<br \/>\nFASLE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2135 (OSSINDEX)<br \/>\nCVE-2013-2135<br \/>\nRidicat<br \/>\nFASLE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>CVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\nCVE-2015-2992<br \/>\nMedium<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2016-0785 (OSSINDEX)<br \/>\nCVE-2016-0785<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>CVE-2016-1181<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2016-4003 (OSSINDEX)<br \/>\nCVE-2016-4003<br \/>\nRidicat<br \/>\nFALSE<br \/>\nVulnerabilitate la Struts 2<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>SONATYPE-2017-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2017-7672<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nDuplicat la CVE-2017-9804<\/p>\n<p>SONATYPE-2016-0127<br \/>\n\u2014<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>struts2-core:2.3.30<br \/>\n\u2014<br \/>\nCVE-2016-6795<br \/>\nCVE-2016-6795<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9787<br \/>\nCVE-2017-9787<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9791<br \/>\nCVE-2017-9791<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9793<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nDuplicat la CVE-2018-1327<\/p>\n<p>\u2014<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9805<br \/>\nCVE-2017-9805<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2016-4003<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nSe aplic\u0103 la Apache Struts 2.x p\u00e2n\u0103 la 2.3.28, iar aceasta este versiunea 2.3.30. Cu toate acestea, conform descrierii, CVE este valabil pentru toate versiunile Struts 2, dac\u0103 se folose\u0219te JRE 1.7 sau mai pu\u021bin. Se pare c\u0103 au vrut s\u0103 fie siguri, dar mai degrab\u0103 pare un FALSE.<\/p>\n<p>\u2014<br \/>\nCVE-2018-1327<br \/>\nCVE-2018-1327<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nRidicat<br \/>\nTRUE<br \/>\nAceasta este vulnerabilitatea de care au profitat atacatorii la Equifax \u00een 2017.<\/p>\n<p>CVE-2017-12611<br \/>\nCVE-2017-12611<br \/>\n\u2014<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>CVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nRidicat<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nPentru struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nPentru struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nPentru commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la taglib<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nSe aplic\u0103 la struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la taglib<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nPentru struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nPentru struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nSub commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la tiles<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nMedium<br \/>\nFALSE<br \/>\nPentru struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nRidicat<br \/>\nFALSE<br \/>\nNu se aplic\u0103 la taglib<\/p>\n<p>Sursa: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516660\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b. Software Composition Analysis \u2014 SCA) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0440\u0430\u0441\u0442\u0435\u0442 \u043f\u043e \u043c\u0435\u0440\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u044b\u0445 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 open source \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Synopsys, Sonatype, Snyk, White Source. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 The State of Open Source Security Vulnerabilities 2020 \u0447\u0438\u0441\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 open source \u0432 2019 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e\u0447\u0442\u0438 \u0432 1.5 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92520,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92519","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"ro_RO\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47DevSecOps: principii de func\u021bionare \u0219i compara\u021bie SCA. Partea \u00eent\u00e2i | ProHoster","description":"Semnifica\u021bia analizei componentelor software externe (eng.","canonical_url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"ro_RO","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.","og:url":"https:\/\/prohoster.info\/ro\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-28T05:42:26+00:00","article:modified_time":"2020-08-28T05:42:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92519","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:06:40","updated":"2022-10-01 01:38:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/92519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/comments?post=92519"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/posts\/92519\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media\/92520"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/media?parent=92519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/categories?post=92519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/ro\/wp-json\/wp\/v2\/tags?post=92519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}