{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>D\u00f4le\u017eitos\u0165 anal\u00fdzy tret\u00edch komponentov softv\u00e9ru (angl. Software Composition Analysis \u2014 SCA) v procese v\u00fdvoja rastie s ka\u017edoro\u010dn\u00fdmi spr\u00e1vami o zranite\u013enostiach open source kni\u017en\u00edc, ktor\u00e9 ber\u00fa na seba spolo\u010dnosti Synopsys, Sonatype, Snyk, White Source. Pod\u013ea spr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Stav zranite\u013enost\u00ed open source bezpe\u010dnosti 2020<\/a><\/noindex> po\u010det zisten\u00fdch zranite\u013enost\u00ed v open source v roku 2019 vzr\u00e1stol takmer o 1,5-kr\u00e1t v porovnan\u00ed s predch\u00e1dzaj\u00facim rokom, pri\u010dom komponenty s otvoren\u00fdm k\u00f3dom s\u00fa pou\u017e\u00edvan\u00e9 v 60 % a\u017e 80 % projektov. Ak sa obr\u00e1time na nez\u00e1visl\u00fd n\u00e1zor, procesy SCA s\u00fa samostatnou praxou OWASP SAMM a BSIMM ako ukazovate\u013e zrelosti, pri\u010dom v prvej polovici roku 2020 OWASP vydala nov\u00fd \u0161tandard OWASP Software Component Verification Standard (SCVS), ktor\u00fd poskytuje najlep\u0161ie praktiky na overenie tret\u00edch komponentov v dod\u00e1vate\u013eskom re\u0165azci softv\u00e9ru.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/2a82121d42f9d317f3862a2d7869fdd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nJeden z najv\u00fdznamnej\u0161\u00edch pr\u00edpadov <noindex><a rel=\"nofollow\" href=\"https:\/\/xakep.ru\/2017\/09\/14\/equifax-dejstvitelno-vzlomali-cherez-bag-v-apache-struts-no-uyazvimost-okazalas-staroj\/\">nastalo<\/a><\/noindex> s spolo\u010dnos\u0165ou Equifax v m\u00e1ji 2017. Nezn\u00e1mi \u00fato\u010dn\u00edci z\u00edskali inform\u00e1cie o 143 mili\u00f3noch Ameri\u010danov, vr\u00e1tane cel\u00fdch mien, adries, \u010d\u00edsel soci\u00e1lneho zabezpe\u010denia a vodi\u010dsk\u00fdch preukazov. V 209 000 pr\u00edpadoch sa v dokumentoch nach\u00e1dzali aj \u00fadaje o bankov\u00fdch kart\u00e1ch obet\u00ed. Tento \u00fanik d\u00e1t sa stal v d\u00f4sledku zneu\u017eitia kritickej zranite\u013enosti v Apache Struts 2 (CVE-2017-5638), pri\u010dom oprava bola vydan\u00e1 u\u017e v marci 2017. Spolo\u010dnos\u0165 mala dva mesiace na nain\u0161talovanie aktualiz\u00e1cie, av\u0161ak nikto sa o to nepostaral.<\/p>\n<p>V tomto \u010dl\u00e1nku sa bude diskutova\u0165 o ot\u00e1zke v\u00fdberu n\u00e1stroja na vykon\u00e1vanie SCA z h\u013eadiska kvality v\u00fdsledkov anal\u00fdzy. Taktie\u017e bude uveden\u00e9 funk\u010dn\u00e9 porovnanie n\u00e1strojov. Proces integr\u00e1cie do CI\/CD a mo\u017enosti integr\u00e1cie ponech\u00e1me na nasleduj\u00face publik\u00e1cie. \u0160irok\u00fd zoznam n\u00e1strojov bol predstaven\u00fd OWASP <noindex><a rel=\"nofollow\" href=\"https:\/\/owasp.org\/www-community\/Component_Analysis\">na svojej str\u00e1nke<\/a><\/noindex>, ale v r\u00e1mci tohto preh\u013eadu budeme hovori\u0165 len o najpopul\u00e1rnej\u0161om open source n\u00e1stroji Dependency Check, o trochu menej zn\u00e1mej open source platforme Dependency Track a Enterprise rie\u0161en\u00ed Sonatype Nexus IQ. Taktie\u017e presk\u00famame, ako tieto rie\u0161enia funguj\u00fa a porovn\u00e1me z\u00edskan\u00e9 v\u00fdsledky z h\u013eadiska falo\u0161n\u00fdch poplachov.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/0580758082abd9950aa9c483d546f1ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Princ\u00edp fungovania<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/jeremylong.github.io\/DependencyCheck\/\">Dependency Check<\/a><\/noindex> \u2014 je n\u00e1stroj (CLI, maven, jenkins modul, ant), ktor\u00fd analyzuje s\u00fabory projektu, zbiera fragmenty inform\u00e1ci\u00ed o z\u00e1vislostiach (n\u00e1zov bal\u00edka, groupid, n\u00e1zov \u0161pecifik\u00e1cie, verzia\u2026) a vytv\u00e1ra re\u0165azec CPE \u2014 (Common Platform Enumeration), Package URL (PURL) a odha\u013euje zranite\u013enosti pre CPE\/PURL z datab\u00e1z (NVD, Sonatype OSS Index, NPM Audit API\u2026), po \u010dom vytv\u00e1ra jednorazov\u00fa spr\u00e1vu vo form\u00e1te HTML, JSON, XML\u2026<\/p>\n<p>Pozrime sa, ako vyzer\u00e1 CPE:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>\u010cas\u0165:<\/b> Uvedenie, \u017ee komponent patr\u00ed k aplik\u00e1cii (a), opera\u010dn\u00e9mu syst\u00e9mu (o), hardv\u00e9ru (h) (Povinn\u00fd bod)<\/li>\n<li><b>Predajca:<\/b> N\u00e1zov v\u00fdrobcu produktu (Povinn\u00fd bod)<\/li>\n<li><b>Produkt:<\/b> N\u00e1zov produktu (Povinn\u00fd bod)<\/li>\n<li><b>Verzia:<\/b> Verzia komponentu (Zastaran\u00fd bod)<\/li>\n<li><b>Aktualiz\u00e1cia:<\/b> Aktualiz\u00e1cia bal\u00edka<\/li>\n<li><b>Ed\u00edcia:<\/b> Dedi\u010dn\u00e1 verzia (Zastaran\u00fd bod)<\/li>\n<li><b>Jazyk:<\/b> Jazyk definovan\u00fd v RFC-5646<\/li>\n<li><b>SW Ed\u00edcia:<\/b> Verzia softv\u00e9ru<\/li>\n<li><b>Cie\u013eov\u00fd SW:<\/b> Softv\u00e9rov\u00e9 prostredie, v ktorom produkt funguje<\/li>\n<li><b>Cie\u013eov\u00fd HW:<\/b> Hardv\u00e9rov\u00e9 prostredie, v ktorom produkt funguje<\/li>\n<li><b>In\u00e9:<\/b> Inform\u00e1cie o dod\u00e1vate\u013eovi alebo produkte<\/li>\n<\/ul>\n<p>\nPr\u00edklad CPE vyzer\u00e1 nasledovne:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*<\/code><\/pre>\n<p>\nRe\u0165azec znamen\u00e1, \u017ee CPE verzia 2.3 popisuje komponentu aplik\u00e1cie od v\u00fdrobcu <code>pivotal_software <\/code>s n\u00e1zvom <code>spring_framework<\/code> verzie 3.0.0. Ak otvor\u00edme zranite\u013enos\u0165 <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0225\">CVE-2014-0225<\/a><\/noindex> v NVD, tak m\u00f4\u017eeme vidie\u0165 zmienku o tejto CPE. Prv\u00fd probl\u00e9m, na ktor\u00fd si hne\u010f treba d\u00e1va\u0165 pozor \u2014 CVE v NVD, pod\u013ea CPE, hl\u00e1si probl\u00e9m vo frameworku, nie v konkr\u00e9tnom komponente. To znamen\u00e1, \u017ee ak s\u00fa v\u00fdvoj\u00e1ri silne viazan\u00ed na framework a zisten\u00e1 zranite\u013enos\u0165 sa net\u00fdka t\u00fdch modulov, ktor\u00e9 pou\u017e\u00edvaj\u00fa v\u00fdvoj\u00e1ri, bezpe\u010dnostn\u00fd expert sa tak \u010di onak bude musie\u0165 zaobera\u0165 touto CVE a zamyslie\u0165 sa nad aktualiz\u00e1ciou.<\/p>\n<p>URL adresa sa tie\u017e pou\u017e\u00edva n\u00e1strojmi SCA. Form\u00e1t URL adresy bal\u00edka je nasledovn\u00fd:<\/p>\n<pre><code class=\"plaintext\">scheme:type\/namespace\/name@version?qualifiers#subpath<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>S\u0441heme: <\/b>V\u017edy bude 'pkg', ktor\u00fd ozna\u010duje, \u017ee ide o adresu bal\u00edka (Povinn\u00e1 polo\u017eka)<\/li>\n<li><b>Typ:<\/b> \u201eTyp\u201c bal\u00edka alebo \u201eprotokol\u201c bal\u00edka, napr\u00edklad maven, npm, nuget, gem, pypi at\u010f. (Povinn\u00fd bod)<\/li>\n<li><b>Namespace:<\/b> Nejak\u00fd prefix n\u00e1zvu, ako je identifik\u00e1tor skupiny Maven, vlastn\u00edk obrazu Docker, u\u017e\u00edvate\u013e alebo organiz\u00e1cia GitHub. Nepovinn\u00e9 a z\u00e1vis\u00ed od typu.<\/li>\n<li><b>N\u00e1zov:<\/b> N\u00e1zov bal\u00edka (Povinn\u00fd bod)<\/li>\n<li><b>Verzia:<\/b> Verzia bal\u00edka<\/li>\n<li><b>Qualifiers:<\/b> Dodato\u010dn\u00e9 kvalifika\u010dn\u00e9 \u00fadaje pre bal\u00edk, ako s\u00fa opera\u010dn\u00fd syst\u00e9m, architekt\u00fara, distrib\u00facia at\u010f. Nepovinn\u00e9 a z\u00e1visiace od typu polo\u017eky.<\/li>\n<li><b>Subcesta:<\/b> Dodato\u010dn\u00e1 cesta v bal\u00edku vo vz\u0165ahu k kore\u0148u bal\u00edka<\/li>\n<\/ul>\n<p>\nNapr\u00edklad:<\/p>\n<pre><code class=\"plaintext\">pkg:golang\/google.golang.org\/genproto#googleapis\/api\/annotations\npkg:maven\/org.apache.commons\/io@1.3.4\npkg:pypi\/django-package@1.11.1.dev1<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/dependencytrack.org\/\">Dependency Track<\/a><\/noindex> \u2014 on-premise webov\u00e1 platforma, ktor\u00e1 prij\u00edma hotov\u00e9 Bill of Materials (BOM) vytvoren\u00e9 <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/CycloneDX\">CycloneDX<\/a><\/noindex> a <noindex><a rel=\"nofollow\" href=\"https:\/\/spdx.org\/licenses\/\">SPDX<\/a><\/noindex>, teda hotov\u00e9 \u0161pecifik\u00e1cie o existuj\u00facich z\u00e1vislostiach. Ide o XML s\u00fabor s popisom z\u00e1vislost\u00ed \u2014 n\u00e1zov, hash, adresa bal\u00edka, vydavate\u013e, licencia. N\u00e1sledne Dependency Track analyzuje BOM, preveruje existuj\u00face CVE identifikovan\u00e9 z\u00e1vislostiam z datab\u00e1zy zranite\u013enost\u00ed (NVD, Sonatype OSS Index \u2026), po \u010dom vytv\u00e1ra grafy, po\u010d\u00edta metriky a pravidelne aktualizuje \u00fadaje o stave zranite\u013enost\u00ed komponentov. <\/p>\n<p>Pr\u00edklad toho, ako m\u00f4\u017ee vyzera\u0165 BOM vo form\u00e1te XML:<\/p>\n<pre><code class=\"xml\">Apache\n      org.apache.tomcat\n      tomcat-catalina\n      9.0.14\n      \n        3942447fac867ae5cdb3229b658f4d48\n        e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a\n        f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b\n        e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282\n      \n      \n        \n          Apache-2.0\n        \n      \n      pkg:maven\/org.apache.tomcat\/tomcat-catalina@9.0.14\n    \n      <!-- More components here --><\/code><\/pre>\n<p>\nBOM sa m\u00f4\u017ee pou\u017e\u00edva\u0165 nielen ako vstupn\u00e9 parametre pre Dependency Track, ale aj na inventariz\u00e1ciu softv\u00e9rov\u00fdch komponentov v dod\u00e1vate\u013eskom re\u0165azci, napr\u00edklad na poskytnutie z\u00e1kazn\u00edkovi softv\u00e9ru. V roku 2014 bol v USA dokonca navrhnut\u00fd z\u00e1kon <noindex><a rel=\"nofollow\" href=\"https:\/\/www.congress.gov\/bill\/113th-congress\/house-bill\/5793\">\u201eCyber Supply Chain Management and Transparency Act of 2014\u201c<\/a><\/noindex>, ktor\u00fd stanovoval, \u017ee pri n\u00e1kupe softv\u00e9ru by v\u0161etky \u0161t\u00e1tne in\u0161tit\u00facie mali po\u017eadova\u0165 BOM na prevenciu pou\u017eitia zranite\u013en\u00fdch komponentov, av\u0161ak z\u00e1kon tak nikdy nevst\u00fapil do platnosti.<\/p>\n<p>Ke\u010f sa vr\u00e1tim k SCA, Dependency Track m\u00e1 hotov\u00e9 integr\u00e1cie s platformami pre notifik\u00e1cie ako Slack, syst\u00e9mami na spr\u00e1vu zranite\u013enost\u00ed ako Kenna Security. Je tie\u017e potrebn\u00e9 spomen\u00fa\u0165, \u017ee Dependency Track navy\u0161e identifikuje zastaran\u00e9 verzie bal\u00edkov a poskytuje inform\u00e1cie o licenci\u00e1ch (v\u010faka podpore SPDX).<\/p>\n<p>Ak hovor\u00edme presne o kvalite SCA, existuje tu z\u00e1sadn\u00fd rozdiel.<\/p>\n<p>Dependency Track neprij\u00edma projekt ako vstupn\u00e9 \u00fadaje, ale prij\u00edma pr\u00e1ve BOM. To znamen\u00e1, \u017ee ak chceme overi\u0165 projekt, najprv mus\u00edme vygenerova\u0165 bom.xml, napr\u00edklad pomocou CycloneDX. T\u00fdm p\u00e1dom Dependency Track priamo z\u00e1vis\u00ed od CycloneDX. Z\u00e1rove\u0148 to poskytuje mo\u017enos\u0165 prisp\u00f4sobenia. Tak t\u00edm OZON nap\u00edsal <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ozonru\/cyclonedx-go\">modul CycloneDX<\/a><\/noindex> na zostavenie BOM s\u00faborov pre projekty v Golangu s cie\u013eom \u010fal\u0161ieho skenovania cez Dependency Track.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/sonatype.ru\/#nexusiq\">Nexus IQ<\/a><\/noindex> je komer\u010dn\u00e9 rie\u0161enie SCA od spolo\u010dnosti Sonatype, ktor\u00e9 je sou\u010d\u00e1stou ekosyst\u00e9mu Sonatype, kam patr\u00ed aj Nexus Repository Manager. Nexus IQ m\u00f4\u017ee prij\u00edma\u0165 ako vstupn\u00e9 d\u00e1ta war arch\u00edvy (pre java projekty) cez webov\u00e9 rozhranie alebo API, tak aj BOM, ak va\u0161a organiz\u00e1cia nestihla prestavi\u0165 z CycloneDX na nov\u00e9 rie\u0161enie. Na rozdiel od open source rie\u0161en\u00ed, IQ sa odvol\u00e1va nielen na CP\/PURL k identifikovanej komponente a zodpovedaj\u00facej zranite\u013enosti v datab\u00e1ze, ale zoh\u013ead\u0148uje aj vlastn\u00e9 v\u00fdskumy, napr\u00edklad n\u00e1zov zranite\u013enej funkcie alebo triedy. Mechanizmy IQ bud\u00fa podrobne presk\u00faman\u00e9 nesk\u00f4r pri anal\u00fdze v\u00fdsledkov.<\/p>\n<p>Zhrnieme niektor\u00e9 v\u00fdsledky t\u00fdkaj\u00face sa funk\u010dn\u00fdch vlastnost\u00ed a pos\u00fadime podporovan\u00e9 jazyky na anal\u00fdzu:<\/p>\n<p>Jazyk<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Java<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>C\/C++<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>C#<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>.Net<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Erlang<br \/>\n\u2014<br \/>\n\u2014<br \/>\n+<\/p>\n<p>JavaScript (NodeJS)<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>PHP<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Python<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Ruby<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Perl<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Scala<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Objective C<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Swift<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>R<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Go<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>\nFunk\u010dn\u00e9 mo\u017enosti<\/p>\n<p>Funk\u010dn\u00e9 mo\u017enosti<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Mo\u017enos\u0165 zabezpe\u010di\u0165 kontrolu komponentov pou\u017eit\u00fdch v zdrojovom k\u00f3de na licen\u010dn\u00fa \u010distotu<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Mo\u017enos\u0165 skenovania a anal\u00fdzy na pr\u00edtomnos\u0165 zranite\u013enost\u00ed a licen\u010dnej \u010distoty pre Docker obrazy<br \/>\n+ Integr\u00e1cia s Clair<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Mo\u017enos\u0165 nastavi\u0165 bezpe\u010dnostn\u00fa politiku pre pou\u017e\u00edvanie kni\u017en\u00edc s otvoren\u00fdm zdrojom<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Mo\u017enos\u0165 skenovania repozit\u00e1rov s otvoren\u00fdm zdrojom na pr\u00edtomnos\u0165 zranite\u013en\u00fdch komponentov<br \/>\n+ RubyGems, Maven, NPM, Nuget, Pypi, Conan, Bower, Conda, Go, p2, R, Yum, Helm, Docker, CocoaPods, Git LFS<br \/>\n\u2014<br \/>\n+ Hex, RubyGems, Maven, NPM, Nuget, Pypi<\/p>\n<p>Existencia \u0161pecializovanej v\u00fdskumnej skupiny<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Pr\u00e1ca v uzavretom obvode<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Pou\u017eitie extern\u00fdch datab\u00e1z<br \/>\n+ Uzavret\u00e1 datab\u00e1za Sonatype<br \/>\n+ Sonatype OSS, NPM Public Advisors<br \/>\n+ Sonatype OSS, NPM Public Advisors, RetireJS, VulnDB, podpora vlastnej datab\u00e1zy zranite\u013enost\u00ed<\/p>\n<p>Mo\u017enos\u0165 filtrova\u0165 komponenty s otvoren\u00fdm zdrojom pri pokuse o nahranie do v\u00fdvojov\u00e9ho obvodu pod\u013ea nakonfigurovan\u00fdch polit\u00edk<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Odpor\u00fa\u010dania na opravu zranite\u013enost\u00ed, pr\u00edtomnos\u0165 odkazov na opravy<br \/>\n+<br \/>\n+- (z\u00e1vis\u00ed od popisu v verejn\u00fdch datab\u00e1zach)<br \/>\n+- (z\u00e1vis\u00ed od popisu v verejn\u00fdch datab\u00e1zach)<\/p>\n<p>Hodnotenie zisten\u00fdch zranite\u013enost\u00ed pod\u013ea z\u00e1va\u017enosti<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Rolov\u00e1 model pr\u00edstupu<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Podpora rozhrania pr\u00edkazov\u00e9ho riadku CLI<br \/>\n+<br \/>\n+<br \/>\n+- (iba pre CycloneDX)<\/p>\n<p>V\u00fdber \/ triedenie zranite\u013enost\u00ed pod\u013ea stanoven\u00fdch krit\u00e9ri\u00ed<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Dashboard stavu aplik\u00e1ci\u00ed<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Generovanie reportov vo form\u00e1te PDF<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Generovanie reportov vo form\u00e1te JSONCSV<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Podpora sloven\u010diny<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>\nIntegr\u00e1cie<\/p>\n<p>Integr\u00e1cia<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Integr\u00e1cia s LDAP\/Active Directory<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Integr\u00e1cia s kontinu\u00e1lnou integra\u010dnou syst\u00e9mom (continuous integration) Bamboo<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integr\u00e1cia s kontinu\u00e1lnou integra\u010dnou syst\u00e9mom (continuous integration) TeamCity<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integr\u00e1cia s kontinu\u00e1lnou integra\u010dnou syst\u00e9mom (continuous integration) GitLab<br \/>\n+<br \/>\n+- (vo forme pluginu pre GitLab)<br \/>\n+<\/p>\n<p>Integr\u00e1cia s kontinu\u00e1lnou integra\u010dnou syst\u00e9mom (continuous integration) Jenkins<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Pr\u00edtomnos\u0165 pluginov pre IDE<br \/>\n+ IntelliJ, Eclipse, Visual Studio<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Podpora prisp\u00f4sobenej integr\u00e1cie prostredn\u00edctvom webov\u00fdch slu\u017eieb (API) n\u00e1stroja<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<h3>Dependency Check<\/h3>\n<p><\/p>\n<h4>Prv\u00fd beh<\/h4>\n<p>\nSpust\u00edme Dependency Check na \u00famyselne zranite\u013enej aplik\u00e1cii <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/appsecco\/dvja\">DVJA<\/a><\/noindex>.<\/p>\n<p>Na to vyu\u017eijeme <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jeremylong\/DependencyCheck\">Dependency Check Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.owasp:dependency-check-maven:check<\/code><\/pre>\n<p>\nV d\u00f4sledku toho sa v adres\u00e1ri target objav\u00ed dependency-check-report.html.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/d5b9fe5a8eb68569387dd0bfd38af459.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOtvor\u00edme s\u00fabor. Po s\u00fahrnnej inform\u00e1cii o celkovom po\u010dte zranite\u013enost\u00ed m\u00f4\u017eeme vidie\u0165 inform\u00e1cie o zranite\u013enostiach s vysokou \u00farov\u0148ou z\u00e1va\u017enosti a d\u00f4veryhodnosti, vr\u00e1tane ozna\u010denia bal\u00edka, CPE a po\u010dtu CVE.<\/p>\n<p>Nasleduje podrobnej\u0161ie inform\u00e1cie, konkr\u00e9tne to, na z\u00e1klade \u010doho bolo prijat\u00e9 rozhodnutie (evidence), teda ist\u00fd BOM.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/53dd89b0ff20c4c51aaf7412399e7fd9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u010ealej nasleduje CPE, PURL a popis CVE. Odpor\u00fa\u010dania na opravu nie s\u00fa prilo\u017een\u00e9, preto\u017ee ch\u00fdbaj\u00fa v datab\u00e1ze NVD.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/ba2021aa8b6bf175383298b2c2a71670.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa systematick\u00e9 prezeranie v\u00fdsledkov skenovania je mo\u017en\u00e9 nastavi\u0165 Nginx s minim\u00e1lnymi nastaveniami, alebo posiela\u0165 z\u00edskan\u00e9 defekty do syst\u00e9mu riadenia defektov, ktor\u00e9 podporuj\u00fa konektory k Dependency Check. Napr\u00edklad Defect Dojo. <\/p>\n<h3>Dependency Track<\/h3>\n<p><\/p>\n<h4>In\u0161tal\u00e1cia<\/h4>\n<p>\nDependency Track, na druhej strane, je webov\u00e1 platforma s grafmi, a preto tu neexistuje probl\u00e9m s ukladan\u00edm defektov do extern\u00e9ho rie\u0161enia. <br \/>\nPre in\u0161tal\u00e1ciu s\u00fa podporovan\u00e9 nasleduj\u00face scen\u00e1re: Docker, WAR, Executable WAR. <\/p>\n<h4>Prv\u00fd beh<\/h4>\n<p>\nPrejdeme na URL spusten\u00e9ho servisu. Prihl\u00e1sime sa cez admin\/admin, zmen\u00edme prihlasovacie \u00fadaje a dostaneme sa na Dashboard. \u010eal\u0161ie, \u010do urob\u00edme \u2014 vytvor\u00edme projekt pre testovaciu aplik\u00e1ciu v Jave v<i> Home\/Projects \u2192 Vytvori\u0165 projekt <\/i>. Ako pr\u00edklad vezmeme DVJA.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/338aaa1c9ca0ac99f2e857f8ce001a02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKe\u010f\u017ee Dependency Track m\u00f4\u017ee prij\u00edma\u0165 ako vstup iba BOM, je potrebn\u00e9 tento BOM z\u00edska\u0165. Vyu\u017eijeme <noindex><a rel=\"nofollow\" href=\"https:\/\/github.coam\/CycloneDX\/cyclonedx-maven-plugin\">CycloneDX Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom<\/code><\/pre>\n<p>\nZ\u00edskame bom.xml a nahr\u00e1me s\u00fabor v vytvorenom projekte <i>DVJA \u2192 Z\u00e1vislosti \u2192 Nahra\u0165 BOM<\/i>.<\/p>\n<p>Prejdeme do sekcie Administr\u00e1cia \u2192 Anal\u00fdzy. Rozumieme, \u017ee m\u00e1me zapnut\u00fd iba Intern\u00fd analyz\u00e1tor, ktor\u00fd zah\u0155\u0148a NVD. Pripoj\u00edme aj Sonatype OSS Index.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/3879a9a3d5f227d9740a984e7b1b91b2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTakto z\u00edskame nasleduj\u00faci preh\u013ead pre n\u00e1\u0161 projekt:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/004f2ab3383acb87e3d5e8c0fba1f3c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV zozname m\u00f4\u017eeme n\u00e1js\u0165 jednu zranite\u013enos\u0165, ktor\u00e1 sa uplat\u0148uje na Sonatype OSS:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/e459f08218f890b46fb4050c30da63c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nHlavn\u00e9 sklamanie bolo v tom, \u017ee Dependency Track u\u017e neprij\u00edma xml spr\u00e1vy Dependency Check. Posledn\u00e9 podporovan\u00e9 verzie integr\u00e1cie s Dependency Check boli 1.0.0 \u2013 4.0.2, zatia\u013e \u010do ja som testoval 5.3.2.<\/p>\n<p>Tu s\u00fa <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/d2WMONyBbTw\">videu<\/a><\/noindex> (a <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/IPWPISSk5rc\">tu<\/a><\/noindex>), ke\u010f to e\u0161te bolo mo\u017en\u00e9. <\/p>\n<h3>Nexus IQ <\/h3>\n<p><\/p>\n<h4>Prv\u00fd beh<\/h4>\n<p>\nIn\u0161tal\u00e1cia Nexus IQ prebieha z arch\u00edvov <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/iqserver\/installing\/iq-server-installation\">dokumen\u00e1cie<\/a><\/noindex>, ale my sme pre tieto \u00fa\u010dely zostavili obraz Docker.<\/p>\n<p>Po prihl\u00e1sen\u00ed do konzoly je potrebn\u00e9 vytvori\u0165 Organiz\u00e1ciu a Aplik\u00e1ciu.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/4c6df91bad77e87ea066ff3514a03644.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/d8580ba46852e4d97625a22e215c21d3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/d99ce4e47218001fd1a76722e2633bea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAko vid\u00edte, nastavenie v pr\u00edpade IQ je o nie\u010do komplikovanej\u0161ie, preto\u017ee mus\u00edme tie\u017e vytvori\u0165 politiky aplikovate\u013en\u00e9 na r\u00f4zne \u201e\u0161t\u00e1di\u00e1\u201c (dev, build, stage, release). To je potrebn\u00e9 na blokovanie zranite\u013en\u00fdch komponentov, ke\u010f sa pos\u00favame po pipeline bli\u017e\u0161ie k produ, alebo ich zablokovanie hne\u010f, ke\u010f sa dostan\u00fa do Nexus Repo pri s\u0165ahovan\u00ed v\u00fdvoj\u00e1rmi.<\/p>\n<p>Aby sme poc\u00edtili rozdiel medzi open source a enterprise, vykon\u00e1me rovnak\u00e9 skenovanie cez Nexus IQ podobne cez <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/integrations\/sonatype-clm-for-maven\">Maven plugin<\/a><\/noindex>, predt\u00fdm vytvoren\u00edm testovacej aplik\u00e1cie v rozhran\u00ed NexusIQ <code>dvja-test-and-compare<\/code>:<\/p>\n<pre><code class=\"plaintext\">mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.applicationId=dvja-test-and-compare -Dclm.serverUrl= -Dclm.username= -Dclm.password=\n<\/code><\/pre>\n<p>\nPrejdeme na URL k vygenerovanej spr\u00e1ve v webovom rozhran\u00ed IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/f81f998037ba53ef62298955077d044d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTu m\u00f4\u017eete vidie\u0165 v\u0161etky poru\u0161enia politiky s uveden\u00edm r\u00f4znej \u00farovne z\u00e1va\u017enosti (od Info po Security Critical). P\u00edsmeno D ved\u013ea komponentu znamen\u00e1, \u017ee komponent je Priama z\u00e1vislos\u0165, a p\u00edsmeno T ved\u013ea komponentu znamen\u00e1, \u017ee komponent je Transit\u00edvna z\u00e1vislos\u0165.<\/p>\n<p>Mimochodom, spr\u00e1va <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/open-source-security\/\">State of Open Source Security Report 2020<\/a><\/noindex> od Snyk uv\u00e1dza, \u017ee viac ako 70% zranite\u013enost\u00ed open source zisten\u00fdch v Node.js, Java a Ruby sa nach\u00e1dza v transit\u00edvnych z\u00e1vislostiach.<\/p>\n<p>Ak otvor\u00edme jedno z poru\u0161en\u00ed politiky Nexus IQ, m\u00f4\u017eeme vidie\u0165 popis komponentu, ako aj Version Graph, ktor\u00fd ukazuje umiestnenie aktu\u00e1lnej verzie na \u010dasovej osi, a tie\u017e v akom momente prest\u00e1va by\u0165 zranite\u013enos\u0165 zranite\u013enou. V\u00fd\u0161ka st\u013apcov na grafe ukazuje popularitu vyu\u017e\u00edvania tejto komponenty.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/d33968a5ce5904da6f50133f882521fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAk prejdeme do sekcie zranite\u013enost\u00ed a rozbal\u00edme CVE, m\u00f4\u017eeme si pre\u010d\u00edta\u0165 popis tejto zranite\u013enosti, odpor\u00fa\u010dania na opravu, ako aj d\u00f4vod, pre\u010do sa t\u00e1to komponenta dostala pod poru\u0161enie, teda pr\u00edtomnos\u0165 triedy <code>DiskFileitem.class<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/6d91b98a9a9a1a62264f1b4194f33ca4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/c9e580ad178a9c0307ed1e63d6dd244d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZhrnieme len tie, ktor\u00e9 sa t\u00fdkaj\u00fa extern\u00fdch komponentov Java, bez komponentov js. V z\u00e1tvork\u00e1ch uvedieme po\u010det zranite\u013enost\u00ed, ktor\u00e9 boli n\u00e1jden\u00e9 mimo NVD.<\/p>\n<p><b>Celkovo Nexus IQ: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 62<\/li>\n<li>Zranite\u013en\u00e9 z\u00e1vislosti: 16<\/li>\n<li>N\u00e1jden\u00e9 zranite\u013enosti: 42 (8 sonatype db)<\/li>\n<\/ul>\n<p>\n<b>Celkovo Dependency Check: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 47<\/li>\n<li>Zranite\u013en\u00e9 z\u00e1vislosti: 13<\/li>\n<li>N\u00e1jden\u00e9 zranite\u013enosti: 91 (14 sonatype oss)<\/li>\n<\/ul>\n<p>\n<b>Celkovo Dependency Track: <\/b><\/p>\n<ul>\n<li>Naskenovan\u00e9 z\u00e1vislosti: 59<\/li>\n<li>Zranite\u013en\u00e9 z\u00e1vislosti: 10<\/li>\n<li>N\u00e1jden\u00e9 zranite\u013enosti: 51 (1 sonatype oss)<\/li>\n<\/ul>\n<p>\n\u010eal\u0161\u00edm krokom analyzujeme z\u00edskan\u00e9 v\u00fdsledky a zist\u00edme, \u010do z t\u00fdchto zranite\u013enost\u00ed je skuto\u010dnou chybou a \u010do je falo\u0161n\u00fd poplach.<\/p>\n<h3>Zrieknutie sa zodpovednosti<\/h3>\n<p>\nToto hodnotenie nie je nepopierate\u013enou pravdou. Pred autorom nebolo cie\u013eom vyzdvihn\u00fa\u0165 konkr\u00e9tny n\u00e1stroj na pozad\u00ed ostatn\u00fdch. Zmyslom hodnotenia bolo uk\u00e1za\u0165 mechanizmy fungovania n\u00e1strojov SCA a sp\u00f4soby overovania ich v\u00fdsledkov.<\/p>\n<h3>Porovnanie v\u00fdsledkov<\/h3>\n<p>\n<b>Podmienky:<\/b><\/p>\n<p><b>Falo\u0161n\u00fdm poplachom vo vz\u0165ahu k zranite\u013enostiam extern\u00fdch komponentov je:<\/b><\/p>\n<ul>\n<li><b>Nes\u00falad CVE s identifikovanou komponentou<\/b><\/li>\n<li>Napr\u00edklad, ak je zranite\u013enos\u0165 identifikovan\u00e1 vo frameworku struts2, a n\u00e1stroj ozna\u010duje komponentu frameworku struts-tiles, na ktor\u00fa sa t\u00e1to zranite\u013enos\u0165 nevz\u0165ahuje, ide o falo\u0161n\u00fd poplach.<\/li>\n<li><b>Nes\u00falad CVE s identifikovanou verziou komponenty<\/b><\/li>\n<li>Napr\u00edklad, zranite\u013enos\u0165 sa via\u017ee na verziu python &gt; 3.5 a n\u00e1stroj ozna\u010d\u00ed za zranite\u013en\u00fa verziu 2.7 \u2014 to je falo\u0161n\u00fd poplach, preto\u017ee zranite\u013enos\u0165 sa v skuto\u010dnosti vz\u0165ahuje iba na vetvu produktu 3.x. <\/li>\n<li> <b>Kop\u00edrovanie CVE<\/b><\/li>\n<li>Napr\u00edklad, ak SCA identifikoval CVE, ktor\u00fd umo\u017e\u0148uje realizova\u0165 RCE, a potom SCA ozna\u010duje pre t\u00fa ist\u00fa komponentu CVE vz\u0165ahuj\u00facu sa na produkty Cisco, ktor\u00e9 s\u00fa n\u00e1chyln\u00e9 na t\u00fato RCE. V takom pr\u00edpade bude falo\u0161n\u00fd poplach.<\/li>\n<li>Napr\u00edklad, CVE bola n\u00e1jden\u00e1 v komponente spring-web, po \u010dom SCA ozna\u010duje t\u00fa ist\u00fa CVE v in\u00fdch komponentoch r\u00e1mca Spring Framework, zatia\u013e \u010do CVE nem\u00e1 vz\u0165ah k in\u00fdm komponentom. V takom pr\u00edpade bude v\u00fdsledok false positive. <\/li>\n<\/ul>\n<p>\nPrieskum sa s\u00fastre\u010fuje na projekt Open Source DVJA. V prieskume sa z\u00fa\u010dastnili iba java komponenty (bez js).<\/p>\n<h3>Zhrnut\u00e9 v\u00fdsledky<\/h3>\n<p>\nPrejdeme rovno k v\u00fdsledkom manu\u00e1lneho preh\u013eadu odhalen\u00fdch zranite\u013enost\u00ed. S \u00faplnou spr\u00e1vou pre ka\u017ed\u00fa CVE sa m\u00f4\u017eete obozn\u00e1mi\u0165 v Pr\u00edlohe. <\/p>\n<p><i>Zhrnut\u00e9 v\u00fdsledky pre v\u0161etky zranite\u013enosti:<\/i><\/p>\n<p>Parameter<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Celkovo bolo odhalen\u00fdch zranite\u013enost\u00ed<br \/>\n42<br \/>\n91<br \/>\n51<\/p>\n<p>Nespr\u00e1vne odhalen\u00e9 zranite\u013enosti (false positive)<br \/>\n2(4.76%)<br \/>\n62(68,13%)<br \/>\n29(56.86%)<\/p>\n<p>Neboli n\u00e1jden\u00e9 relevantn\u00e9 zranite\u013enosti (false negative)<br \/>\n10<br \/>\n20<br \/>\n27<\/p>\n<p>\n<i>Zhrnut\u00e9 v\u00fdsledky pod\u013ea komponentov:<\/i><\/p>\n<p>Parameter<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Celkovo bolo odhalen\u00fdch komponentov<br \/>\n62<br \/>\n47<br \/>\n59<\/p>\n<p>Celkovo zranite\u013en\u00fdch komponentov<br \/>\n16<br \/>\n13<br \/>\n10<\/p>\n<p>Nespr\u00e1vne odhalen\u00e9 zranite\u013en\u00e9 komponenty (false positive)<br \/>\n1<br \/>\n5<br \/>\n0<\/p>\n<p>Nespr\u00e1vne odhalen\u00e9 zranite\u013en\u00e9 komponenty (false positive)<br \/>\n0<br \/>\n6<br \/>\n6<\/p>\n<p>\nVybudujeme vizu\u00e1lne grafy, aby sme zhodnotili pomer false positive a false negative k celkov\u00e9mu po\u010dtu zranite\u013enost\u00ed. Na horizont\u00e1lnej osi s\u00fa komponenty a na vertik\u00e1lnej osi odhalen\u00e9 zranite\u013enosti. <\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/967b8e168383299d4a1bf4065f1905ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/2e128ee59e551894c25e4c9e28997008.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/585d7bcef052ef24e4de6c7e1a4e7c0b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNa porovnanie, podobn\u00fd prieskum bol vykonan\u00fd t\u00edmom Sonatype na teste projektu z 1531 komponentov pomocou OWASP Dependency Check. Ako vid\u00edme, pomer hluku k spr\u00e1vnym sp\u00fa\u0161\u0165aniam je porovnate\u013en\u00fd s na\u0161imi v\u00fdsledkami.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/286c34b84f1400af0285b711b3fe87f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Zdroj: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sonatype.com\/why-precision-matters-ebook\">www.sonatype.com\/why-precision-matters-ebook<\/a><\/noindex><\/i><\/p>\n<p>Pozrime sa na niektor\u00e9 CVE z v\u00fdsledkov n\u00e1\u0161ho skenovania, aby sme pochopili pr\u00ed\u010diny tak\u00fdchto v\u00fdsledkov.<\/p>\n<h3>Viac inform\u00e1ci\u00ed<\/h3>\n<p><\/p>\n<h4>\u010c. 1<\/h4>\n<p>\nNajprv si rozoberieme niektor\u00e9 zauj\u00edmav\u00e9 aspekty Sonatype Nexus IQ.<\/p>\n<p>Nexus IQ poukazuje na probl\u00e9m s deserializ\u00e1ciou s mo\u017enos\u0165ou vykonania RCE v Spring Framework viackr\u00e1t. CVE-2016-1000027 v spring-web:3.0.5 po prv\u00fdkr\u00e1t a CVE-2011-2894 v spring-context:3.0.5 a spring-core:3.0.5. Na prv\u00fd poh\u013ead to vyzer\u00e1, ako keby do\u0161lo k duplicite zranite\u013enosti pod\u013ea viacer\u00fdch CVE. Preto\u017ee ak sa pozrieme na CVE-2016-1000027 a CVE-2011-2894 v datab\u00e1ze NVD, vyzer\u00e1 to, \u017ee je to jasn\u00e9.<\/p>\n<p>Komponent<br \/>\nZranite\u013enos\u0165<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>spring-core:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>\nPopis <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-2894\">CVE-2011-2894<\/a><\/noindex> z NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/31b403eca6d7541c766c9a560bfbe6b7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPopis <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-1000027\">CVE-2016-1000027<\/a><\/noindex> z NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/d5b54a6ac15070b12f013eaacd2878f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCVE-2011-2894 sama o sebe je dos\u0165 zn\u00e1ma. V spr\u00e1ve <noindex><a rel=\"nofollow\" href=\"http:\/\/www.pwntester.com\/blog\/2013\/12\/16\/cve-2011-2894-deserialization-spring-rce\/\">White Source zo roku 2011<\/a><\/noindex> t\u00e1to CVE bola uznan\u00e1 ako jedna z naj\u010dastej\u0161ie sa vyskytuj\u00facich. Opis pre CVE-2016-100027 je v NVD v z\u00e1sade obmedzen\u00fd, a aj tak sa zd\u00e1, \u017ee je aplikovate\u013en\u00fd iba pre Spring Framework 4.1.4. Pozrime sa na <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">reference<\/a><\/noindex> a tu sa to st\u00e1va viac-menej jasn\u00fdm. Z <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">\u010dl\u00e1nku Tenable<\/a><\/noindex> rozumieme, \u017ee okrem zranite\u013enosti vo <code>RemoteInvocationSerializingExporter<\/code> v CVE-2011-2894, zranite\u013enos\u0165 sa pozoruje v <code>HttpInvokerServiceExporter<\/code>. O tom n\u00e1s informuje Nexus IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/a33f0853ce892d28eafafe2c8e7b2228.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAv\u0161ak v NVD nie je ni\u010d podobn\u00e9, \u010do sp\u00f4sobuje, \u017ee Dependency Check a Dependency Track dost\u00e1vaj\u00fa falo\u0161ne negat\u00edvne v\u00fdsledky.<\/p>\n<p>Z opisu CVE-2011-2894 m\u00f4\u017eeme tie\u017e us\u00fadi\u0165, \u017ee zranite\u013enos\u0165 skuto\u010dne existuje aj v spring-context:3.0.5 a spring-core:3.0.5. Potvrdenie toho m\u00f4\u017eeme n\u00e1js\u0165 v \u010dl\u00e1nku od toho, kto t\u00fato zranite\u013enos\u0165 objavil.<\/p>\n<h4>\u010c. 2<\/h4>\n<p><\/p>\n<p>Komponent<br \/>\nZranite\u013enos\u0165<br \/>\nV\u00fdsledok<\/p>\n<p>struts2-core:2.3.30<br \/>\nCVE-2016-4003<br \/>\nFALSE<\/p>\n<p>\nAk sa pozrieme na zranite\u013enos\u0165 CVE-2016-4003, pochop\u00edme, \u017ee bola opraven\u00e1 u\u017e vo verzii 2.3.28, napriek tomu n\u00e1m Nexus IQ o nej informuje. V opise zranite\u013enosti je pozn\u00e1mka:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: princ\u00edpy pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1\" src=\"\/wp-content\/uploads\/2020\/08\/081f9006748083727e424b709a338d60.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTo znamen\u00e1, \u017ee zranite\u013enos\u0165 existuje len v kombin\u00e1cii so zastaranou verziou JRE, \u010do n\u00e1m chc\u00fa poveda\u0165. Napriek tomu to pova\u017eujeme za falo\u0161n\u00fd pozit\u00edv, aj ke\u010f nie za najhor\u0161\u00ed.<\/p>\n<h4>\u010c. 3<\/h4>\n<p><\/p>\n<p>Komponent<br \/>\nZranite\u013enos\u0165<br \/>\nV\u00fdsledok<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\nTRUE<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-7672<br \/>\nFALSE<\/p>\n<p>\nAk sa pozrieme na opis CVE-2017-9804 a CVE-2017-7672, pochop\u00edme, \u017ee probl\u00e9m spo\u010d\u00edva v <code>URLValidator class<\/code>, pri\u010dom CVE-2017-9804 vypl\u00fdva z CVE-2017-7672. Existencia druhej zranite\u013enosti neprin\u00e1\u0161a \u017eiadnu u\u017eito\u010dn\u00fa hodnotu okrem toho, \u017ee jej z\u00e1va\u017enos\u0165 vzr\u00e1stla na vysok\u00fa, tak\u017ee to m\u00f4\u017eeme pova\u017eova\u0165 za nadbyto\u010dn\u00fd \u0161um.<\/p>\n<p>Vo v\u0161eobecnosti neboli pre Nexus IQ n\u00e1jden\u00e9 \u010fal\u0161ie falo\u0161n\u00e9 pozit\u00edvy.<\/p>\n<h3>\u010c. 4<\/h3>\n<p>\nExistuje nieko\u013eko aspektov, ktor\u00e9 vy\u010dle\u0148uj\u00fa IQ na pozad\u00ed in\u00fdch rie\u0161en\u00ed.<\/p>\n<p>Komponent<br \/>\nZranite\u013enos\u0165<br \/>\nV\u00fdsledok<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2020-5398<br \/>\nTRUE<\/p>\n<p>CVE v NVD uv\u00e1dza, \u017ee plat\u00ed iba pre verzie 5.2.x do 5.2.3, 5.1.x do 5.1.13, a verzie 5.0.x do 5.0.16, napriek tomu, ak sa pozrieme na opis CVE v Nexus IQ, uvid\u00edme nasledovn\u00e9:<br \/>\n<i>Advisory Deviation Notice: T\u00edm security research spolo\u010dnosti Sonatype zistil, \u017ee t\u00e1to zranite\u013enos\u0165 bola zaveden\u00e1 vo verzii 3.0.2.RELEASE a nie 5.0.x, ako je uveden\u00e9 v poradenstve.<\/i><\/p>\n<p>Po tomto nasleduje PoC k tejto zranite\u013enosti, ktor\u00fd oznamuje, \u017ee je pr\u00edtomn\u00e1 vo verzii 3.0.5.<\/p>\n<p>Falo\u0161ne negat\u00edvne v\u00fdsledky sa posielaj\u00fa k Dependency Check a Dependency Track.<\/p>\n<h3>\u010c. 5<\/h3>\n<p>\nPozrime sa na falo\u0161n\u00e9 pozit\u00edvy pre Dependency Check a Dependency Track.<\/p>\n<p>Dependency Check sa osobitne vyzna\u010duje t\u00fdm, \u017ee reflektuje tie CVE, ktor\u00e9 sa t\u00fdkaj\u00fa cel\u00e9ho r\u00e1mca v NVD, na komponenty, ku ktor\u00fdm tieto CVE nie s\u00fa aplikovate\u013en\u00e9. T\u00fdka sa to CVE-2012-0394, CVE-2013-2115, CVE-2014-0114, CVE-2015-0899, CVE-2015-2992, CVE-2016-1181, CVE-2016-1182, ktor\u00e9 Dependency Check \u201cpripnul\u201d na struts-taglib:1.3.8 a struts-tiles-1.3.8. Tieto komponenty nemaj\u00fa ni\u010d spolo\u010dn\u00e9 s t\u00fdm, \u010do je pop\u00edsan\u00e9 v CVE \u2014 spracovanie po\u017eiadaviek, valid\u00e1cia str\u00e1nok at\u010f. To je sp\u00f4soben\u00e9 t\u00fdm, \u017ee to, \u010do sp\u00e1ja tieto CVE a komponenty, je len r\u00e1mec, v d\u00f4sledku \u010doho to Dependency Check pova\u017euje za zranite\u013enos\u0165.<\/p>\n<p>Rovnak\u00e1 situ\u00e1cia je so spring-tx:3.0.5, a podobn\u00e1 situ\u00e1cia s struts-core:1.3.8. Pre struts-core Dependency Check a Dependency Track na\u0161li ve\u013emi ve\u013ea zranite\u013enost\u00ed, ktor\u00e9 v skuto\u010dnosti platia pre struts2-core, ktor\u00fd je v podstate samostatn\u00fd framework. V tomto pr\u00edpade Nexus IQ spr\u00e1vne porozumel situ\u00e1cii a v t\u00fdch CVE, ktor\u00e9 vydal, uviedol, \u017ee struts-core dosiahol koniec \u017eivotnosti a je potrebn\u00e9 prejs\u0165 na struts2-core.<\/p>\n<h3>\u010d. 6<\/h3>\n<p>\nV niektor\u00fdch situ\u00e1ci\u00e1ch je nespravodliv\u00e9 interpretova\u0165 zjavn\u00e9 chyby Dependency Check a Dependency Track. Konkr\u00e9tne CVE-2013-4152, CVE-2013-6429, CVE-2013-6430, CVE-2013-7315, CVE-2014-0054, CVE-2014-0225, CVE-2014-0225, ktor\u00e9 Dependency Check a Dependency Track priradili k spring-core:3.0.5, v skuto\u010dnosti patria k spring-web:3.0.5. \u010cas\u0165 t\u00fdchto CVE bola n\u00e1jden\u00e1 aj Nexus IQ, av\u0161ak IQ ich spr\u00e1vne identifikoval k inej komponente. To, \u017ee tieto zranite\u013enosti neboli n\u00e1jden\u00e9 v spring-core, neznamen\u00e1, \u017ee neexistuj\u00fa vo frameworku ako takom, a open-source n\u00e1stroje spravodlivo pouk\u00e1zali na tieto zranite\u013enosti (len ich trocha minuli). <\/p>\n<h3>Zhrnutie<\/h3>\n<p>\nAko m\u00f4\u017eeme vidie\u0165, ur\u010dovanie presnosti identifikovan\u00fdch zranite\u013enost\u00ed ru\u010dn\u00fdm presk\u00faman\u00edm neprin\u00e1\u0161a jednozna\u010dn\u00e9 v\u00fdsledky, \u010do vedie k sporn\u00fdm bodom. V\u00fdsledky s\u00fa tak\u00e9, \u017ee rie\u0161enie Nexus IQ m\u00e1 najni\u017e\u0161\u00ed po\u010det falo\u0161n\u00fdch poplachov a najvy\u0161\u0161iu presnos\u0165. <\/p>\n<p>Predov\u0161etk\u00fdm je to sp\u00f4soben\u00e9 t\u00fdm, \u017ee t\u00edm Sonatype roz\u0161\u00edril popis pre ka\u017ed\u00fa zranite\u013enos\u0165 CVE z NVD vo svojich datab\u00e1zach, uviedol presnos\u0165 a\u017e na \u00farove\u0148 triedy alebo funkcie zranite\u013enosti pre r\u00f4zne verzie komponentov a vykonal \u010fal\u0161\u00ed v\u00fdskum (napr\u00edklad preveroval zranite\u013enosti v star\u0161\u00edch verzi\u00e1ch softv\u00e9ru). <\/p>\n<p>Z\u00e1sadn\u00fd vplyv na v\u00fdsledky maj\u00fa aj zranite\u013enosti, ktor\u00e9 sa nedostali do NVD, ale predsa s\u00fa pr\u00edtomn\u00e9 v datab\u00e1ze Sonatype s ozna\u010den\u00edm SONATYPE. Pod\u013ea spr\u00e1vy <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Stav zranite\u013enost\u00ed open source bezpe\u010dnosti 2020<\/a><\/noindex> o 45% zisten\u00fdch zranite\u013enost\u00ed s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom nie je hl\u00e1sen\u00fdch v NVD. Pod\u013ea datab\u00e1zy WhiteSource, len 29% zo v\u0161etk\u00fdch zranite\u013enost\u00ed s otvoren\u00fdm zdrojov\u00fdm k\u00f3dom, registrovan\u00fdch mimo NVD, sa nakoniec zverejn\u00ed v nej, preto je tak d\u00f4le\u017eit\u00e9 h\u013eada\u0165 zranite\u013enosti aj v in\u00fdch zdrojoch.<\/p>\n<p>Ako v\u00fdsledok, Dependency Check vyd\u00e1va ve\u013ek\u00e9 mno\u017estvo \u0161umu, pri\u010dom opom\u00edna niektor\u00e9 zranite\u013en\u00e9 komponenty. Dependency Track vyd\u00e1va menej \u0161umu a identifikuje ve\u013ek\u00e9 mno\u017estvo komponentov, \u010do vizu\u00e1lne nebij\u00fa do o\u010d\u00ed v webovom rozhran\u00ed.<\/p>\n<p>Praktika v\u0161ak ukazuje, \u017ee open source by mal by\u0165 prv\u00fdm krokom na ceste k vyzrel\u00e9mu DevSecOps. Prv\u00e1 vec, nad ktorou by ste sa mali zamyslie\u0165 pre integr\u00e1ciu SCA do v\u00fdvoja, s\u00fa procesy, a to konkr\u00e9tne diskusie s veden\u00edm a s\u00favisiacimi oddeleniami o tom, ako by mali vyzera\u0165 ide\u00e1lne procesy vo va\u0161ej organiz\u00e1cii. Mo\u017eno sa uk\u00e1\u017ee, \u017ee pre va\u0161u organiz\u00e1ciu spo\u010diatku bud\u00fa Dependency Check alebo Dependency Track a v\u0161etky podnikov\u00e9 rie\u0161enia logick\u00fdm pokra\u010dovan\u00edm v d\u00f4sledku zvy\u0161uj\u00facej sa zlo\u017eitosti vyv\u00edjan\u00fdch aplik\u00e1ci\u00ed.<\/p>\n<p>                        <b class=\"spoiler_title\">Pr\u00edloha A. V\u00fdsledky vz\u0165ahuj\u00face sa na komponenty<\/b><br \/>\n                        <b>Podmienen\u00e9 ozna\u010denia:<\/b><\/p>\n<ul>\n<li>Vysok\u00e1 \u2014 zranite\u013enosti vysok\u00e9ho a kritick\u00e9ho stup\u0148a v komponente<\/li>\n<li>Stredn\u00e1 \u2014 Zranite\u013enosti stredn\u00e9ho stup\u0148a kritickosti v komponente<\/li>\n<li>PRAVDA \u2014 Spr\u00e1vne identifikovan\u00e1 zranite\u013enos\u0165 (True positive issue)<\/li>\n<li>NEPRAVDA \u2014 Falo\u0161n\u00fd poplach (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponent<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nV\u00fdsledok<\/p>\n<p>dom4j: 1.6.1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>commons-codec:1:10<br \/>\nStredn\u00e1<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nVysok\u00e1<br \/>\nkomponent nebol n\u00e1jden\u00fd<\/p>\n<p>TRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nVysok\u00e1<br \/>\nkomponent nebol n\u00e1jden\u00fd<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nStredn\u00e1<br \/>\nkomponent nebol n\u00e1jden\u00fd<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\nStredn\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nStredn\u00e1<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-core:1.3.8<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>xwork-core: 2.3.30<br \/>\nVysok\u00e1<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>struts2-core: 2.3.30<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Pr\u00edloha B. V\u00fdsledky vz\u0165ahuj\u00face sa na zranite\u013enosti<\/b><br \/>\n                        <b>Podmienen\u00e9 ozna\u010denia:<\/b><\/p>\n<ul>\n<li>Vysok\u00e1 \u2014 zranite\u013enosti vysok\u00e9ho a kritick\u00e9ho stup\u0148a v komponente<\/li>\n<li>Stredn\u00e1 \u2014 Zranite\u013enosti stredn\u00e9ho stup\u0148a kritickosti v komponente<\/li>\n<li>PRAVDA \u2014 Spr\u00e1vne identifikovan\u00e1 zranite\u013enos\u0165 (True positive issue)<\/li>\n<li>NEPRAVDA \u2014 Falo\u0161n\u00fd poplach (False positive issue)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponent<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nZ\u00e1va\u017enos\u0165<br \/>\nV\u00fdsledok<br \/>\nKoment\u00e1r<\/p>\n<p>dom4j: 1.6.1<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nN\u00edzka<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nCVE-2019-17571<br \/>\nCVE-2019-17571<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-9488<br \/>\n\u2014<br \/>\nN\u00edzka<br \/>\nTRUE<\/p>\n<p>SONATYPE-2010-0053<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\n\u2014<br \/>\nCVE-2015-6420<br \/>\nCVE-2015-6420<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nDuplikuje RCE(OSSINDEX)<\/p>\n<p>\u2014<br \/>\nCVE-2017-15708<br \/>\nCVE-2017-15708<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nDuplikuje RCE(OSSINDEX)<\/p>\n<p>SONATYPE-2015-0002<br \/>\nRCE (OSSINDEX)<br \/>\nRCE(OSSINDEX)<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>SONATYPE-2014-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2019-10086<br \/>\nCVE-2019-10086<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje iba na verzie 1.9.2+<\/p>\n<p>commons-codec:1:10<br \/>\nSONATYPE-2012-0050<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2019-2692<br \/>\nCVE-2019-2692<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-2875<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nT\u00e1 ist\u00e1 zranite\u013enos\u0165 ako CVE-2019-2692, ale s dodatkom \u201e\u00fatoky m\u00f4\u017eu v\u00fdznamne ovplyvni\u0165 \u010fal\u0161ie produkty\u201c<\/p>\n<p>\u2014<br \/>\nCVE-2017-15945<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na mysql-connector-java<\/p>\n<p>\u2014<br \/>\nCVE-2020-2933<br \/>\n\u2014<br \/>\nN\u00edzka<br \/>\nFALSE<br \/>\nDuplik\u00e1t CVE-2020-2934<\/p>\n<p>CVE-2020-2934<br \/>\nCVE-2020-2934<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nCVE-2018-1270<br \/>\nkomponent nebol n\u00e1jden\u00fd<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2018-1257<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<br \/>\nkomponent nebol n\u00e1jden\u00fd<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2014-0225<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2011-2730<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2018-1272<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2020-5398<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<br \/>\nUk\u00e1\u017ekov\u00fd pr\u00edklad v prospech IQ: \u201eT\u00edm bezpe\u010dnostn\u00e9ho v\u00fdskumu Sonatype zistil, \u017ee t\u00e1to zranite\u013enos\u0165 bola zaveden\u00e1 vo verzii 3.0.2.RELEASE a nie 5.0.x, ako bolo uveden\u00e9 v ozn\u00e1men\u00ed.\u201c<\/p>\n<p>CVE-2013-6429<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2014-0054<br \/>\n\u2014<br \/>\nCVE-2014-0054<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2013-6430<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<br \/>\nkomponent nebol n\u00e1jden\u00fd<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\nCVE-2011-2730<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nDuplik\u00e1t tej istej zranite\u013enosti v spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\nCVE-2013-6429<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\nCVE-2013-7315<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nSPLIT z CVE-2013-4152. + Zranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\nCVE-2014-0054<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nDuplik\u00e1t tej istej zranite\u013enosti v spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\nCVE-2014-1904<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\nCVE-2014-3625<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\nCVE-2016-9878<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\nCVE-2018-1270<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nPre spring-expression \/ spring-messages<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\nCVE-2018-1271<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa vz\u0165ahuje k komponentu spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\nCVE-2018-1272<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2014-3578<br \/>\nCVE-2014-3578 (OSSINDEX)<br \/>\nCVE-2014-3578<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>SONATYPE-2015-0327<br \/>\n\u2014<br \/>\n\u2014<br \/>\nN\u00edzka<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nSONATYPE-2016-0104<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2011-2894<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 sa nevz\u0165ahuje na spring-tx<\/p>\n<p>struts-core:1.3.8<br \/>\n\u2014<br \/>\nCVE-2011-5057 (OSSINDEX)<\/p>\n<p>Stredn\u00e1<br \/>\nFASLE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0391 (OSSINDEX)<br \/>\nCVE-2012-0391<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0094 (OSSINDEX)<br \/>\nCVE-2014-0094<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0113 (OSSINDEX)<br \/>\nCVE-2014-0113<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>CVE-2016-1182<br \/>\n3VE-2016-1182<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2011-5057<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0392 (OSSINDEX)<br \/>\nCVE-2012-0392<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0393 (OSSINDEX)<br \/>\nCVE-2012-0393<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>CVE-2015-0899<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2012-0394<br \/>\nCVE-2012-0394<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0838 (OSSINDEX)<br \/>\nCVE-2012-0838<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1965 (OSSINDEX)<br \/>\nCVE-2013-1965<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1966 (OSSINDEX)<br \/>\nCVE-2013-1966<br \/>\nVysok\u00e1<br \/>\nFASLE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\nCVE-2013-2115<br \/>\nVysok\u00e1<br \/>\nFASLE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2134 (OSSINDEX)<br \/>\nCVE-2013-2134<br \/>\nVysok\u00e1<br \/>\nFASLE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2135 (OSSINDEX)<br \/>\nCVE-2013-2135<br \/>\nVysok\u00e1<br \/>\nFASLE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>CVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\nCVE-2015-2992<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2016-0785 (OSSINDEX)<br \/>\nCVE-2016-0785<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>CVE-2016-1181<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2016-4003 (OSSINDEX)<br \/>\nCVE-2016-4003<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nZranite\u013enos\u0165 pre Struts 2<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>SONATYPE-2017-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2017-7672<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nDuplicit k CVE-2017-9804<\/p>\n<p>SONATYPE-2016-0127<br \/>\n\u2014<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>struts2-core:2.3.30<br \/>\n\u2014<br \/>\nCVE-2016-6795<br \/>\nCVE-2016-6795<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9787<br \/>\nCVE-2017-9787<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9791<br \/>\nCVE-2017-9791<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9793<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nDuplik\u00e1t k CVE-2018-1327<\/p>\n<p>\u2014<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9805<br \/>\nCVE-2017-9805<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2016-4003<br \/>\n\u2014<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nAplikuje sa na Apache Struts 2.x do 2.3.28, pri\u010dom verzia je 2.3.30. Napriek tomu, vych\u00e1dzaj\u00fac z opisu, CVE plat\u00ed pre v\u0161etky verzie Struts 2, ak je pou\u017eit\u00fd JRE 1.7 a men\u0161ie. Zjavne sa tu rozhodli poisti\u0165, ale viac to vyzer\u00e1 na FALSE<\/p>\n<p>\u2014<br \/>\nCVE-2018-1327<br \/>\nCVE-2018-1327<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nVysok\u00e1<br \/>\nTRUE<br \/>\nTo je t\u00e1 zranite\u013enos\u0165, ktor\u00fa zneu\u017eili \u00fato\u010dn\u00edci v Equifax v 2017 roku<\/p>\n<p>CVE-2017-12611<br \/>\nCVE-2017-12611<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>CVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nVysok\u00e1<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nPre struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nPre struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nPre commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na taglib<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nVz\u0165ahuje sa na struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na taglib<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nPre struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nPre struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nPod commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na tiles<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nStredn\u00e1<br \/>\nFALSE<br \/>\nPre struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nVysok\u00e1<br \/>\nFALSE<br \/>\nNevz\u0165ahuje sa na taglib<\/p>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516660\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b. Software Composition Analysis \u2014 SCA) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0440\u0430\u0441\u0442\u0435\u0442 \u043f\u043e \u043c\u0435\u0440\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u044b\u0445 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 open source \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Synopsys, Sonatype, Snyk, White Source. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 The State of Open Source Security Vulnerabilities 2020 \u0447\u0438\u0441\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 open source \u0432 2019 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e\u0447\u0442\u0438 \u0432 1.5 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92520,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92519","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sk_SK\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47DevSecOps: z\u00e1sady pr\u00e1ce a porovnanie SCA. \u010cas\u0165 prv\u00e1 | ProHoster","description":"D\u00f4le\u017eitos\u0165 anal\u00fdzy \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 komponentov \u041f\u041e (angl.","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.","og:url":"https:\/\/prohoster.info\/sk\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-28T05:42:26+00:00","article:modified_time":"2020-08-28T05:42:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92519","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:06:40","updated":"2022-10-01 01:38:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/92519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=92519"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/92519\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/92520"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=92519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=92519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=92519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}