{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p>R\u00ebnd\u00ebsia e analiz\u00ebs s\u00eb komponenteve t\u00eb jashtme t\u00eb softuerit (angl. Software Composition Analysis \u2014 SCA) gjat\u00eb procesit t\u00eb zhvillimit po rritet me kalimin e raportit vjetor mbi dob\u00ebsit\u00eb e bibliotekave open source, t\u00eb cilat publikohen nga kompanit\u00eb Synopsys, Sonatype, Snyk, White Source. Sipas raportit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Gjendja e Dob\u00ebsive t\u00eb Siguris\u00eb n\u00eb Open Source 2020<\/a><\/noindex> numri i dob\u00ebsive t\u00eb zbuluara n\u00eb open source n\u00eb 2019 u rrit pothuajse 1.5 her\u00eb n\u00eb krahasim me vitin e kaluar, ndon\u00ebse komponentet me kod t\u00eb hapur jan\u00eb p\u00ebrdorur n\u00eb 60% deri n\u00eb 80% t\u00eb projekteve. N\u00ebse shikojm\u00eb mendimin e pavarur, proceset SCA jan\u00eb nj\u00eb praktik\u00eb e ve\u00e7ant\u00eb e OWASP SAMM dhe BSIMM si nj\u00eb tregues i pjekuris\u00eb, dhe n\u00eb gjysm\u00ebn e par\u00eb t\u00eb vitit 2020, OWASP publikoi standardin e ri OWASP Software Component Verification Standard (SCVS), q\u00eb ofron praktikat m\u00eb t\u00eb mira p\u00ebr verifikimin e komponent\u00ebve t\u00eb jasht\u00ebm n\u00eb zinxhirin e furnizimit t\u00eb softuerit.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/2a82121d42f9d317f3862a2d7869fdd6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><br \/>\nNj\u00eb nga rastet m\u00eb treguese <noindex><a rel=\"nofollow\" href=\"https:\/\/xakep.ru\/2017\/09\/14\/equifax-dejstvitelno-vzlomali-cherez-bag-v-apache-struts-no-uyazvimost-okazalas-staroj\/\">ndodhi<\/a><\/noindex> \u00ebsht\u00eb rasti me kompanin\u00eb Equifax n\u00eb maj 2017. Haker\u00eb t\u00eb panjohur mor\u00ebn informacionin e 143 milion amerikan\u00ebve, duke p\u00ebrfshir\u00eb emrat e plot\u00eb, adresat, numrat e sigurimeve shoq\u00ebrore dhe patentat. N\u00eb 209,000 raste, dokumentet gjithashtu p\u00ebrmbanin informacion mbi kartat e bankave t\u00eb t\u00eb prekurve. Kjo rrjedhje ndodhi si pasoj\u00eb e shfryt\u00ebzimit t\u00eb nj\u00eb dob\u00ebsie kritike n\u00eb Apache Struts 2 (CVE-2017-5638), nd\u00ebrsa nj\u00eb rregullim ishte l\u00ebshuar q\u00eb n\u00eb mars 2017. Kompania pati dy muaj p\u00ebr t\u00eb instaluar azhurnimin, por askush nuk e mori parasysh k\u00ebt\u00eb.<\/p>\n<p>N\u00eb k\u00ebt\u00eb artikull do t\u00eb diskutohet zgjedhja e nj\u00eb instrumenti p\u00ebr kryerjen e SCA nga k\u00ebndv\u00ebshtrimi i cil\u00ebsis\u00eb s\u00eb rezultateve t\u00eb analiz\u00ebs. Gjithashtu do t\u00eb ofrohen krahasime funksionale t\u00eb instrumenteve. Procesi i integrimit n\u00eb CI\/CD dhe mund\u00ebsit\u00eb e integrimit do t'i l\u00ebm\u00eb p\u00ebr publikuar m\u00eb von\u00eb. Nj\u00eb list\u00eb e gjer\u00eb instrumentesh u paraqit nga OWASP <noindex><a rel=\"nofollow\" href=\"https:\/\/owasp.org\/www-community\/Component_Analysis\">n\u00eb faqen e saj<\/a><\/noindex>, por n\u00eb kuad\u00ebr t\u00eb k\u00ebtij rishikimi do t\u00eb prekim vet\u00ebm instrumentin m\u00eb t\u00eb popullarizuar open source Dependency Check, platform\u00ebn open source pak m\u00eb pak t\u00eb njohur Dependency Track dhe zgjidhjen Enterprise Sonatype Nexus IQ. Gjithashtu do t\u00eb shqyrtojm\u00eb se si funksionojn\u00eb k\u00ebto zgjidhje dhe do t\u00eb krahasojm\u00eb rezultatet e marra p\u00ebr rastet e rreme.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/0580758082abd9950aa9c483d546f1ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<\/p>\n<h3>Parimi i funksionimit<\/h3>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/jeremylong.github.io\/DependencyCheck\/\">Dependency Check<\/a><\/noindex> \u00cbsht\u00eb nj\u00eb utilit t\u00eb linj\u00ebs komand\u00ebs (CLI, maven, moduli jenkins, ant), i cili analizon skedar\u00ebt e projektit, mbledh fragmente informacioni mbi var\u00ebsit\u00eb (emri i paket\u00ebs, groupid, titulli i specifikimit, versioni\u2026), ndryn nj\u00eb varg CPE \u2014 (Common Platform Enumeration), URL e Paket\u00ebs (PURL) dhe identifikon p\u00ebr CPE\/PURL vulnerabilitete nga databazat (NVD, Sonatype OSS Index, NPM Audit API\u2026), pas s\u00eb cil\u00ebs ndryn nj\u00eb raport nj\u00ebher\u00ebsh n\u00eb formatin HTML, JSON, XML\u2026<\/p>\n<p>Le t\u00eb shohim se si duket CPE:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Pjesa:<\/b> T\u00eb dh\u00ebna q\u00eb tregon se komponenti i p\u00ebrket aplikacionit (a), sistemit operativ (o), harduerit (h) (Pika e detyrueshme)<\/li>\n<li><b>Prodhuesi:<\/b> Emri i prodhuesit t\u00eb produktit (Pika e detyrueshme)<\/li>\n<li><b>Produkti:<\/b> Emri i produktit (Pika e detyrueshme)<\/li>\n<li><b>Versioni:<\/b> Versioni i komponent\u00ebs (Pika e vjetruar)<\/li>\n<li><b>P\u00ebrdit\u00ebsim:<\/b> P\u00ebrdit\u00ebsimi i paket\u00ebs<\/li>\n<li><b>Edisioni:<\/b> Versioni i trash\u00ebguar (Pika e vjetruar)<\/li>\n<li><b>Gjuha:<\/b> Gjuha e p\u00ebrcaktuar n\u00eb RFC-5646<\/li>\n<li><b>Edisioni SW:<\/b> Versioni i softuerit<\/li>\n<li><b>SW i Destinuar:<\/b> Mjedisi programor n\u00eb t\u00eb cilin operon produkti<\/li>\n<li><b>HW i Destinuar:<\/b> Mjedisi hardueror n\u00eb t\u00eb cilin operon produkti<\/li>\n<li><b>Tjet\u00ebr:<\/b> Informacion mbi ofruesin ose produktin<\/li>\n<\/ul>\n<p>\nNj\u00eb shembull CPE duket si m\u00eb posht\u00eb:<\/p>\n<pre><code class=\"plaintext\">cpe:2.3:a:pivotal_software:spring_framework:3.0.0:*:*:*:*:*:*:*<\/code><\/pre>\n<p>\nVargu tregon se CPE versioni 2.3 p\u00ebrshkruan nj\u00eb komponent aplikacioni nga prodhuesi <code>pivotal_software <\/code>me emrin <code>spring_framework<\/code> versioni 3.0.0. N\u00ebse hapim vulnerabilitetin <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2014-0225\">CVE-2014-0225<\/a><\/noindex> n\u00eb NVD, mund t\u00eb shohim p\u00ebrmendjen e k\u00ebtij CPE. Problemi i par\u00eb, n\u00eb t\u00eb cilin duhet t\u00eb p\u00ebrqendrohemi, \u00ebsht\u00eb se CVE n\u00eb NVD, sipas CPE, njofton p\u00ebr nj\u00eb probl\u00e9m n\u00eb framework, e jo n\u00eb nj\u00eb komponent t\u00eb caktuar. Dometh\u00ebn\u00eb, n\u00ebse zhvilluesit jan\u00eb t\u00eb lidhur ngusht\u00eb me framework-un dhe vulnerabiliteti i zbuluar nuk ndikon n\u00eb modulat q\u00eb p\u00ebrdorin zhvilluesit, nj\u00eb specialist i siguris\u00eb do t\u00eb duhet p\u00ebrfundimisht t\u00eb hetoj\u00eb k\u00ebt\u00eb CVE dhe t\u00eb mendoj\u00eb p\u00ebr p\u00ebrdit\u00ebsimin.<\/p>\n<p>URL-ja \u00ebsht\u00eb gjithashtu e p\u00ebrdorur nga mjetet SCA. Formati i URL-s\u00eb s\u00eb paket\u00ebs \u00ebsht\u00eb si n\u00eb vijim:<\/p>\n<pre><code class=\"plaintext\">scheme:type\/namespace\/name@version?qualifiers#subpath<\/code><\/pre>\n<p><\/p>\n<ul>\n<li><b>Schemi: <\/b>Do t\u00eb ket\u00eb gjithmon\u00eb 'pkg' q\u00eb tregon se kjo \u00ebsht\u00eb nj\u00eb URL e paket\u00ebs (Element i detyruesh\u00ebm)<\/li>\n<li><b>Tipi:<\/b> \u2018Tipi\u2019 i paket\u00ebs ose \u2018protokolli\u2019 i paket\u00ebs, si p.sh. maven, npm, nuget, gem, pypi, etj. (Pika e detyrueshme)<\/li>\n<li><b>Namespace:<\/b> Nj\u00eb prefiks i caktuar emri, si\u00e7 \u00ebsht\u00eb identifikuesi i grupit Maven, pronari i imazhit Docker, p\u00ebrdoruesi ose organizata GitHub. T\u00eb opcional dhe varet nga tipi.<\/li>\n<li><b>Emri:<\/b> Emri i paket\u00ebs (Pika e detyrueshme)<\/li>\n<li><b>Versioni:<\/b> Versioni i paket\u00ebs<\/li>\n<li><b>Kualifikuesit:<\/b> T\u00eb dh\u00ebnat e tjera kualifikuese p\u00ebr paket\u00ebn, si\u00e7 jan\u00eb OS, arkitektura, shp\u00ebrndarja, etj. Jan\u00eb opsionale dhe varen nga lloji i elementit.<\/li>\n<li><b>Subpika:<\/b> Rruge shtes\u00eb n\u00eb paket\u00eb n\u00eb lidhje me rr\u00ebnj\u00ebn e paket\u00ebs<\/li>\n<\/ul>\n<p>\nP\u00ebr shembull:<\/p>\n<pre><code class=\"plaintext\">pkg:golang\/google.golang.org\/genproto#googleapis\/api\/annotations\npkg:maven\/org.apache.commons\/io@1.3.4\npkg:pypi\/django-package@1.11.1.dev1<\/code><\/pre>\n<p>\n<noindex><a rel=\"nofollow\" href=\"https:\/\/dependencytrack.org\/\">Dependency Track<\/a><\/noindex> \u2014 platform\u00eb web-on-premise q\u00eb pranon Bill of Materials (BOM) t\u00eb gatshme t\u00eb formuara <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/CycloneDX\">CycloneDX<\/a><\/noindex> dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/spdx.org\/licenses\/\">SPDX<\/a><\/noindex>, pra specifikime t\u00eb gatshme p\u00ebr var\u00ebsit\u00eb ekzistuese. Ky \u00ebsht\u00eb nj\u00eb skedar XML q\u00eb p\u00ebrshkruan var\u00ebsit\u00eb \u2014 emri, hashes, URL e paket\u00ebs, botuesi, licenca. M\u00eb pas, Dependency Track analizon BOM, shqyrton var\u00ebsit\u00eb p\u00ebr CVE-t\u00eb ekzistuese nga baza e t\u00eb dh\u00ebnave t\u00eb dob\u00ebsive (NVD, Sonatype OSS Index ...), pas \u00e7ka nd\u00ebrtuon grafika, llogarit metrika, duke p\u00ebrdit\u00ebsuar rregullisht t\u00eb dh\u00ebnat p\u00ebr statusin e dob\u00ebsive t\u00eb komponent\u00ebve. <\/p>\n<p>Shembuj se si mund t\u00eb duket BOM n\u00eb formatin XML:<\/p>\n<pre><code class=\"xml\">Apache\n      org.apache.tomcat\n      tomcat-catalina\n      9.0.14\n      \n        3942447fac867ae5cdb3229b658f4d48\n        e6b1000b94e835ffd37f4c6dcbdad43f4b48a02a\n        f498a8ff2dd007e29c2074f5e4b01a9a01775c3ff3aeaf6906ea503bc5791b7b\n        e8f33e424f3f4ed6db76a482fde1a5298970e442c531729119e37991884bdffab4f9426b7ee11fccd074eeda0634d71697d6f88a460dce0ac8d627a29f7d1282\n      \n      \n        \n          Apache-2.0\n        \n      \n      pkg:maven\/org.apache.tomcat\/tomcat-catalina@9.0.14\n    \n      <!-- More components here --><\/code><\/pre>\n<p>\nBOM mund t\u00eb p\u00ebrdoret jo vet\u00ebm si parametra hyr\u00ebs p\u00ebr Dependency Track, por edhe p\u00ebr inventarizimin e komponent\u00ebve t\u00eb softuerit n\u00eb zinxhirin e furnizimit, p\u00ebr shembull, p\u00ebr t'i ofruar klientit t\u00eb softuerit. N\u00eb 2014, n\u00eb SHBA u propozua madje nj\u00eb ligj <noindex><a rel=\"nofollow\" href=\"https:\/\/www.congress.gov\/bill\/113th-congress\/house-bill\/5793\">\u00abCyber Supply Chain Management and Transparency Act of 2014\u00bb<\/a><\/noindex>, i cili tha se gjat\u00eb blerjes s\u00eb softuerit, \u00e7do institucion shtet\u00ebror duhet t\u00eb k\u00ebrkonte BOM p\u00ebr t\u00eb parandaluar p\u00ebrdorimin e komponent\u00ebve t\u00eb d\u00ebmtuar, por ligji asnj\u00ebher\u00eb nuk u miratua.<\/p>\n<p>Kthehu te SCA, Dependency Track ka integrime t\u00eb gatshme me Platforma Njoftimi si Slack, sisteme menaxhimi t\u00eb dob\u00ebsive si Kenna Security. \u00cbsht\u00eb gjithashtu e r\u00ebnd\u00ebsishme t\u00eb theksohet se Dependency Track identifikon versionet e vjetra t\u00eb paketave dhe ofron informacion mbi licencat (p\u00ebrmes mb\u00ebshtetjes SPDX).<\/p>\n<p>Kur flasim p\u00ebr cil\u00ebsin\u00eb e SCA, ka nj\u00eb ndryshim thelb\u00ebsor.<\/p>\n<p>Dependency Track nuk pranon projektin si input, por pranon pik\u00ebrisht BOM. Kjo do t\u00eb thot\u00eb se n\u00ebse duam t\u00eb kontrollojm\u00eb projektin, fillimisht duhet t\u00eb gjenerojm\u00eb bom.xml, p\u00ebr shembull, me CycloneDX. K\u00ebshtu q\u00eb, Dependency Track varet drejtp\u00ebrdrejt nga CycloneDX. N\u00eb t\u00eb nj\u00ebjt\u00ebn koh\u00eb, kjo ofron mund\u00ebsi p\u00ebr personalizim. K\u00ebshtu, ekipi i OZON shkroi <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/ozonru\/cyclonedx-go\">modulin CycloneDX<\/a><\/noindex> p\u00ebr nd\u00ebrtimin e skedave BOM p\u00ebr projekte n\u00eb Golang me q\u00ebllim skanimin e m\u00ebpassh\u00ebm p\u00ebrmes Dependency Track.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/sonatype.ru\/#nexusiq\">Nexus IQ<\/a><\/noindex> \u00ebsht\u00eb nj\u00eb zgjidhje komerciale SCA nga kompania Sonatype, e cila \u00ebsht\u00eb pjes\u00eb e ekosistemit Sonatype, ku p\u00ebrfshihet gjithashtu Nexus Repository Manager. Nexus IQ mund t\u00eb pranoj\u00eb si input arkiva war (p\u00ebr projekte java) p\u00ebrmes nd\u00ebrfaqes web ose API, ashtu si dhe BOM, n\u00ebse organizata juaj nuk arriti t\u00eb kaloj\u00eb nga CycloneDX n\u00eb zgjidhjen e re. Ndryshe nga zgjidhjet open source, IQ i referohet jo vet\u00ebm CP\/PURL p\u00ebr komponentin e zbuluar dhe p\u00ebrkat\u00ebsisht dob\u00ebsis\u00eb n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave, por gjithashtu merr parasysh studimet e veta, p\u00ebr shembull, emri i funksionit ose klas\u00ebs s\u00eb dob\u00ebsuar. Mekanizmat IQ do t\u00eb shqyrtohen m\u00eb von\u00eb gjat\u00eb analiz\u00ebs s\u00eb rezultateve.<\/p>\n<p>Le t\u00eb p\u00ebrmbledhim disa p\u00ebrfundime mbi ve\u00e7orit\u00eb funksionale dhe gjithashtu t\u00eb shqyrtojm\u00eb gjuh\u00ebt e mb\u00ebshtetura p\u00ebr analiz\u00eb:<\/p>\n<p>Gjuha<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Java<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>C\/C++<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>C#<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>.Net<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Erlang<br \/>\n\u2014<br \/>\n\u2014<br \/>\n+<\/p>\n<p>JavaScript (NodeJS)<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>PHP<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Python<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Ruby<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Perl<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Scala<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Objective C<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Swift<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>R<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Go<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>\nVe\u00e7orit\u00eb funksionale<\/p>\n<p>Ve\u00e7orit\u00eb funksionale<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Mund\u00ebsia p\u00ebr t\u00eb siguruar kontrollimin e komponent\u00ebve t\u00eb p\u00ebrdorur n\u00eb kodin burimor p\u00ebr past\u00ebrtin\u00eb e licenc\u00ebs<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Mund\u00ebsia p\u00ebr skanimin dhe analiz\u00ebn e dob\u00ebsive dhe past\u00ebrtin\u00eb e licenc\u00ebs p\u00ebr imazhet Docker<br \/>\n+ Integrimi me Clair<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Mund\u00ebsia p\u00ebr t\u00eb konfiguruar politik\u00ebn e siguris\u00eb p\u00ebr p\u00ebrdorimin e bibliotekave me kod burimor<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Mund\u00ebsia p\u00ebr skanimin e depozitave me kod burimor p\u00ebr komponent\u00eb t\u00eb dob\u00ebsuar<br \/>\n+ RubyGems, Maven, NPM, Nuget, Pypi, Conan, Bower, Conda, Go, p2, R, Yum, Helm, Docker, CocoaPods, Git LFS<br \/>\n\u2014<br \/>\n+ Hex, RubyGems, Maven, NPM, Nuget, Pypi<\/p>\n<p>Prania e nj\u00eb grupi k\u00ebrkuesish t\u00eb specializuar<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Puna n\u00eb nj\u00eb rreth t\u00eb mbyllur<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>P\u00ebrdorimi i bazave t\u00eb dh\u00ebnash t\u00eb pal\u00ebve t\u00eb treta<br \/>\n+ Baza e t\u00eb dh\u00ebnave e mbyllur Sonatype<br \/>\n+ Sonatype OSS, NPM Public Advisors<br \/>\n+ Sonatype OSS, NPM Public Advisors, RetireJS, VulnDB, mb\u00ebshtetje p\u00ebr baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb dob\u00ebsive<\/p>\n<p>Mund\u00ebsia p\u00ebr t\u00eb filtruar komponent\u00ebt me kod burimor gjat\u00eb p\u00ebrpjekjes p\u00ebr t'i ngarkuar n\u00eb rrethin e zhvillimit sipas politikave t\u00eb konfiguruara<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Rekomandime p\u00ebr riparimin e dob\u00ebsive, prania e lidhjeve p\u00ebr riparim<br \/>\n+<br \/>\n+- (varet nga p\u00ebrshkrimi n\u00eb bazat publike)<br \/>\n+- (varet nga p\u00ebrshkrimi n\u00eb bazat publike)<\/p>\n<p>Rangimi i dob\u00ebsive t\u00eb zbuluara sipas kriticitetit<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Modeli i rolit t\u00eb aksesit<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Mb\u00ebshtetje p\u00ebr nd\u00ebrfaqen e komand\u00ebs CLI<br \/>\n+<br \/>\n+<br \/>\n+- (vet\u00ebm p\u00ebr CycloneDX)<\/p>\n<p>Selekcioni \/ renditja e dob\u00ebsive sipas kritereve t\u00eb p\u00ebrcaktuara<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Dashboard p\u00ebr gjendjen e aplikacioneve<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Gjenerimi i raporteve n\u00eb formatin PDF<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Gjenerimi i raporteve n\u00eb formatin JSONCSV<br \/>\n+<br \/>\n+<br \/>\n\u2014<\/p>\n<p>Mb\u00ebshtetje p\u00ebr gjuh\u00ebn ruse<br \/>\n\u2014<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>\nMund\u00ebsit\u00eb e Integrimit<\/p>\n<p>Integrimi<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Integrimi me LDAP \/ Active Directory<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<p>Integrimi me sistemin e vazhduesh\u00ebm t\u00eb integrimit (continuous integration) Bamboo<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integrimi me sistemin e vazhduesh\u00ebm t\u00eb integrimit (continuous integration) TeamCity<br \/>\n+<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Integrimi me sistemin e vazhduesh\u00ebm t\u00eb integrimit (continuous integration) GitLab<br \/>\n+<br \/>\n+- (n\u00eb form\u00ebn e nj\u00eb plugini p\u00ebr GitLab)<br \/>\n+<\/p>\n<p>Integrimi me sistemin e vazhduesh\u00ebm t\u00eb integrimit (continuous integration) Jenkins<br \/>\n+<br \/>\n+<br \/>\n+<\/p>\n<p>Prania e plugineve p\u00ebr IDE<br \/>\n+ IntelliJ, Eclipse, Visual Studio<br \/>\n\u2014<br \/>\n\u2014<\/p>\n<p>Mb\u00ebshtetje p\u00ebr integrimin e personalizuar p\u00ebrmes sh\u00ebrbimeve web (API) t\u00eb mjetit<br \/>\n+<br \/>\n\u2014<br \/>\n+<\/p>\n<h3>Dependency Check<\/h3>\n<p><\/p>\n<h4>\u00c7elja e par\u00eb<\/h4>\n<p>\nDo t\u00eb ekzekutojm\u00eb Dependency Check n\u00eb nj\u00eb aplikacion t\u00eb dizajnuar q\u00eb t\u00eb ket\u00eb dob\u00ebsi t\u00eb q\u00ebllimshme <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/appsecco\/dvja\">DVJA<\/a><\/noindex>.<\/p>\n<p>P\u00ebr k\u00ebt\u00eb do t\u00eb shfryt\u00ebzojm\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jeremylong\/DependencyCheck\">Dependency Check Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.owasp:dependency-check-maven:check<\/code><\/pre>\n<p>\nSi rezultat, n\u00eb direktorin\u00eb target do t\u00eb shfaqet dependency-check-report.html.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/d5b9fe5a8eb68569387dd0bfd38af459.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDo ta hapim skedarin. Pas informacionit t\u00eb p\u00ebrmbledhur mbi numrin total t\u00eb dob\u00ebsive, mund t\u00eb shohim informacion mbi dob\u00ebsit\u00eb me nivel t\u00eb lart\u00eb t\u00eb Rrezikshm\u00ebris\u00eb dhe Besueshm\u00ebris\u00eb, duke treguar paket\u00ebn, CPE, numrin CVE.<\/p>\n<p>M\u00eb pas vjen informacioni m\u00eb i detajuar, ve\u00e7an\u00ebrisht se mbi \u00e7far\u00eb baze \u00ebsht\u00eb marr\u00eb vendimi (evidence), dometh\u00ebn\u00eb nj\u00eb BOM.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/53dd89b0ff20c4c51aaf7412399e7fd9.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPastaj vjen CPE, PURL dhe p\u00ebrshkrimi i CVE. Sidoqoft\u00eb, rekomandimet p\u00ebr rregullimin nuk jepen p\u00ebr shkak t\u00eb munges\u00ebs s\u00eb tyre n\u00eb baz\u00ebn NVD.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/ba2021aa8b6bf175383298b2c2a71670.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr nj\u00eb shikim sistematik t\u00eb rezultateve t\u00eb skanimit, mund t\u00eb konfigurohet Nginx me konfigurimet minimale, ose t\u00eb d\u00ebrgohen defektet e marra n\u00eb sistemin e menaxhimit t\u00eb defekteve q\u00eb mb\u00ebshtesin lidhjet me Dependency Check. P\u00ebr shembull, Defect Dojo. <\/p>\n<h3>Dependency Track<\/h3>\n<p><\/p>\n<h4>Instalimi<\/h4>\n<p>\nDependency Track, nga ana e tij, \u00ebsht\u00eb nj\u00eb platform\u00eb web me grafika t\u00eb paraqitura, prandaj problemi i ruajtjes s\u00eb defekteve n\u00eb nj\u00eb zgjidhje t\u00eb jashtme k\u00ebtu nuk \u00ebsht\u00eb i pranish\u00ebm. <br \/>\nP\u00ebr instalimin ka skenar\u00ebt e m\u00ebposht\u00ebm t\u00eb mb\u00ebshtetur: Docker, WAR, Executable WAR. <\/p>\n<h4>\u00c7elja e par\u00eb<\/h4>\n<p>\nKalojm\u00eb n\u00eb URL-n\u00eb e sh\u00ebrbimit t\u00eb nisur. Hyjm\u00eb p\u00ebrmes admin\/admin, ndryshojm\u00eb emrin e p\u00ebrdoruesit dhe fjal\u00ebkalimin, pas s\u00eb cil\u00ebs shkojm\u00eb n\u00eb Dashboard. E ardhshme q\u00eb do t\u00eb b\u00ebjm\u00eb \u2013 do t\u00eb krijojm\u00eb nj\u00eb projekt p\u00ebr nj\u00eb aplikacion provues n\u00eb Java n\u00eb<i> Home\/Projects \u2192 Create Project <\/i>. Si nj\u00eb shembull do t\u00eb marr\u00ebim DVJA.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/338aaa1c9ca0ac99f2e857f8ce001a02.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDuke qen\u00eb se Dependency Track mund t\u00eb pranoj\u00eb si t\u00eb dh\u00ebna hyr\u00ebse vet\u00ebm BOM, ky BOM duhet t\u00eb merret. Do t\u00eb shfryt\u00ebzojm\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.coam\/CycloneDX\/cyclonedx-maven-plugin\">CycloneDX Maven Plugin<\/a><\/noindex>:<\/p>\n<pre><code class=\"plaintext\">mvn org.cyclonedx:cyclonedx-maven-plugin:makeAggregateBom<\/code><\/pre>\n<p>\nMarrim\u00eb bom.xml dhe ngarkojm\u00eb skedarin n\u00eb projektin e krijuar <i>DVJA \u2192 Var\u00ebsit\u00eb \u2192 Ngarko BOM<\/i>.<\/p>\n<p>Tani do t\u00eb shkojm\u00eb n\u00eb Administrim \u2192 Analizuesit. Kuptojm\u00eb se kemi aktivizuar vet\u00ebm Analizuesin e Brendsh\u00ebm, i cili p\u00ebrfshin NVD. Po ashtu do t\u00eb lidhim Sonatype OSS Index.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/3879a9a3d5f227d9740a984e7b1b91b2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebt\u00eb m\u00ebnyr\u00eb do t\u00eb marrim pamjen e m\u00ebposhtme p\u00ebr projektin ton\u00eb:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/004f2ab3383acb87e3d5e8c0fba1f3c3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGjithashtu n\u00eb list\u00eb mund t\u00eb gjeni nj\u00eb dob\u00ebsi q\u00eb i p\u00ebrket Sonatype OSS:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/e459f08218f890b46fb4050c30da63c8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nZhg\u00ebnjimi kryesor ishte se Dependency Track nuk pranon m\u00eb raporte xml t\u00eb Dependency Check. Versionet e fundit t\u00eb mb\u00ebshtetura t\u00eb integrimit me Dependency Check ishin 1.0.0 \u2014 4.0.2, nd\u00ebrsa un\u00eb testova 5.3.2.<\/p>\n<p>Ja <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/d2WMONyBbTw\">video<\/a><\/noindex> (dhe <noindex><a rel=\"nofollow\" href=\"https:\/\/youtu.be\/IPWPISSk5rc\">ja<\/a><\/noindex>), kur ishte ende e mundur. <\/p>\n<h3>Nexus IQ <\/h3>\n<p><\/p>\n<h4>\u00c7elja e par\u00eb<\/h4>\n<p>\nInstalimi i Nexus IQ b\u00ebhet nga arkivat n\u00ebp\u00ebrmjet <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/iqserver\/installing\/iq-server-installation\">dokumentacionin<\/a><\/noindex>, por p\u00ebr k\u00ebto q\u00ebllime ne kemi grumbulluar nj\u00eb imazh Docker.<\/p>\n<p>Pas hyrjes n\u00eb konsol\u00eb, duhet t\u00eb krijojm\u00eb Nj\u00eb Organizat\u00eb dhe Nj\u00eb Aplikacion.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/4c6df91bad77e87ea066ff3514a03644.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/d8580ba46852e4d97625a22e215c21d3.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/d99ce4e47218001fd1a76722e2633bea.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSi\u00e7 mund t\u00eb shihet, konfigurimi n\u00eb rastin e IQ \u00ebsht\u00eb pak m\u00eb i komplikuar, pasi gjithashtu duhet t\u00eb krijojm\u00eb politika q\u00eb jan\u00eb t\u00eb aplikueshme p\u00ebr \"stet\" t\u00eb ndryshme (dev, build, stage, release). Kjo \u00ebsht\u00eb e nevojshme p\u00ebr t\u00eb bllokuar komponent\u00ebt e dob\u00ebt nd\u00ebrsa p\u00ebrparojm\u00eb n\u00eb pipeline drejt produkteve, ose p\u00ebr t\u00eb bllokuar sa her\u00eb q\u00eb ato hyjn\u00eb n\u00eb Nexus Repo gjat\u00eb shkarkimit nga zhvilluesit.<\/p>\n<p>P\u00ebr t\u00eb ndjer\u00eb diferenc\u00ebn mes open source dhe enterprise, do t\u00eb ekzekutojm\u00eb nj\u00eb skanim t\u00eb nj\u00ebjt\u00eb p\u00ebrmes Nexus IQ ngjash\u00ebm si p\u00ebr <noindex><a rel=\"nofollow\" href=\"https:\/\/help.sonatype.com\/integrations\/sonatype-clm-for-maven\">plugin Maven<\/a><\/noindex>, duke krijuar m\u00eb par\u00eb nj\u00eb aplikacion testues n\u00eb nd\u00ebrfaqen e NexusIQ <code>dvja-test-and-compare<\/code>:<\/p>\n<pre><code class=\"plaintext\">mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.applicationId=dvja-test-and-compare -Dclm.serverUrl= -Dclm.username= -Dclm.password=\n<\/code><\/pre>\n<p>\nShkoni n\u00eb URL p\u00ebr raportin e gjeneruar n\u00eb nd\u00ebrfaqen web t\u00eb IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/f81f998037ba53ef62298955077d044d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebtu mund t\u00eb shihni t\u00eb gjith\u00eb shkeljet e politik\u00ebs me tregues t\u00eb nivelit t\u00eb ndrysh\u00ebm t\u00eb r\u00ebnd\u00ebsis\u00eb (nga Info deri t\u00eb Kritikuar p\u00ebr Sigurin\u00eb). Maka D pran\u00eb komponentit tregon se komponenti \u00ebsht\u00eb Var\u00ebsi Direkte, nd\u00ebrsa letra T pran\u00eb komponentit tregon se komponenti \u00ebsht\u00eb Var\u00ebsi Transitive, dometh\u00ebn\u00eb \u00ebsht\u00eb transitive.<\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, raporti <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/open-source-security\/\">State of Open Source Security Report 2020<\/a><\/noindex> nga Snyk tregon se m\u00eb shum\u00eb se 70% e dob\u00ebsive open source q\u00eb jan\u00eb zbuluar n\u00eb Node.js, Java dhe Ruby ndodhen n\u00eb var\u00ebsit\u00eb transitives.<\/p>\n<p>N\u00ebse hapim nj\u00eb nga shkeljet e politik\u00ebs Nexus IQ, mund t\u00eb shohim p\u00ebrshkrimin e komponentit, si dhe Grafikun e Versioneve, i cili tregon vendndodhjen e versionit aktual n\u00eb grafin temporal, si dhe n\u00eb \u00e7far\u00eb momenti dob\u00ebsia ndalon s\u00eb qeni e till\u00eb. Lart\u00ebsia e qirinjve n\u00eb grafik tregon popullaritetin e p\u00ebrdorimit t\u00eb k\u00ebtij komponenti.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/d33968a5ce5904da6f50133f882521fe.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00ebse kaloni n\u00eb seksionin e dob\u00ebsive dhe zgjidhni CVE, mund t\u00eb lexoni p\u00ebrshkrimin e k\u00ebsaj dob\u00ebsie, rekomandimet p\u00ebr ndreqje dhe gjithashtu arsyen pse ky komponent ka r\u00ebn\u00eb n\u00ebn shkelje, dometh\u00ebn\u00eb pranin\u00eb e klas\u00ebs. <code>DiskFileitem.class<\/code>.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/6d91b98a9a9a1a62264f1b4194f33ca4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/c9e580ad178a9c0307ed1e63d6dd244d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nT\u00eb p\u00ebrmbledhim vet\u00ebm ato q\u00eb nd\u00ebrlidhen me komponent\u00ebt e jasht\u00ebm Java, duke hequr komponent\u00ebt js. N\u00eb kllapa do t\u00eb shfaqim numrin e dob\u00ebsive q\u00eb jan\u00eb gjetur jasht\u00eb NVD.<\/p>\n<p><b>S\u00eb bashku Nexus IQ: <\/b><\/p>\n<ul>\n<li>Komponent\u00eb t\u00eb skanuar: 62<\/li>\n<li>Komponent\u00eb t\u00eb dob\u00ebsuar: 16<\/li>\n<li>Dob\u00ebsi t\u00eb gjetura: 42 (8 n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave sonatype)<\/li>\n<\/ul>\n<p>\n<b>S\u00eb bashku Kontrolli i Var\u00ebsive: <\/b><\/p>\n<ul>\n<li>Komponent\u00eb t\u00eb skanuar: 47<\/li>\n<li>Komponent\u00eb t\u00eb dob\u00ebsuar: 13<\/li>\n<li>Dob\u00ebsi t\u00eb gjetura: 91 (14 n\u00eb sonatype oss)<\/li>\n<\/ul>\n<p>\n<b>S\u00eb bashku Ndjekja e Var\u00ebsive: <\/b><\/p>\n<ul>\n<li>Komponent\u00eb t\u00eb skanuar: 59<\/li>\n<li>Komponent\u00eb t\u00eb dob\u00ebsuar: 10<\/li>\n<li>Dob\u00ebsi t\u00eb gjetura: 51 (1 n\u00eb sonatype oss)<\/li>\n<\/ul>\n<p>\nHapi tjet\u00ebr \u00ebsht\u00eb t\u00eb analizojm\u00eb rezultatet e marra dhe t\u00eb kuptojm\u00eb se cilat nga k\u00ebto dob\u00ebsi jan\u00eb defekte reale dhe cilat jan\u00eb alarme false.<\/p>\n<h3>K\u00ebrc\u00ebnimi<\/h3>\n<p>\nKy rishikim nuk \u00ebsht\u00eb nj\u00eb t\u00eb v\u00ebrtet\u00eb t\u00eb padiskutueshme. Para autorit nuk ishte synimi p\u00ebr t\u00eb ve\u00e7uar nj\u00eb mjet n\u00eb mes t\u00eb t\u00eb tjer\u00ebve. Q\u00ebllimi i rishikimit ishte t\u00eb tregonte mekanizmat e pun\u00ebs s\u00eb mjeteve SCA dhe m\u00ebnyrat e verifikimit t\u00eb rezultateve t\u00eb tyre.<\/p>\n<h3>Krahasimi i rezultateve<\/h3>\n<p>\n<b>Kushtet:<\/b><\/p>\n<p><b>Nj\u00eb alarm false n\u00eb lidhje me dob\u00ebsit\u00eb e komponent\u00ebve t\u00eb jasht\u00ebm \u00ebsht\u00eb:<\/b><\/p>\n<ul>\n<li><b>Mosp\u00ebrputhja e CVE-s\u00eb me komponentin e zbuluar<\/b><\/li>\n<li>P\u00ebr shembull, n\u00ebse dob\u00ebsia \u00ebsht\u00eb zbuluar n\u00eb struktur\u00ebn struts2 dhe mjeti tregon n\u00eb komponentin e struktur\u00ebs struts-tiles, t\u00eb cilit kjo dob\u00ebsi nuk i p\u00ebrket, at\u00ebher\u00eb kjo \u00ebsht\u00eb nj\u00eb alarme false.<\/li>\n<li><b>Mosp\u00ebrputhja e CVE-s\u00eb me versionin e zbuluar t\u00eb komponentit<\/b><\/li>\n<li>P\u00ebr shembull, n\u00ebse dob\u00ebsia \u00ebsht\u00eb e lidhur me versionin python &gt; 3.5 dhe mjeti e sh\u00ebnon si t\u00eb dob\u00ebsuar versionin 2.7 \u2014 kjo \u00ebsht\u00eb nj\u00eb alarme false, pasi n\u00eb t\u00eb v\u00ebrtet\u00eb dob\u00ebsia i p\u00ebrket vet\u00ebm deg\u00ebs s\u00eb produktit 3.x. <\/li>\n<li> <b>Duplicimi i CVE-s\u00eb<\/b><\/li>\n<li>P\u00ebr shembull, n\u00ebse SCA ka treguar nj\u00eb CVE q\u00eb lejon realizimin e RCE-s\u00eb, dhe m\u00eb pas SCA tregon p\u00ebr k\u00ebt\u00eb CVE p\u00ebr t\u00eb nj\u00ebjtin komponent, CVE q\u00eb \u00ebsht\u00eb e aplikueshme p\u00ebr produktet Cisco t\u00eb prekura nga kjo RCE, at\u00ebher\u00eb kjo do t\u00eb jet\u00eb nj\u00eb alarme false.<\/li>\n<li>P\u00ebr shembull, n\u00ebse CVE u gjet n\u00eb komponentin spring-web, dhe m\u00eb pas SCA tregon p\u00ebr t\u00eb nj\u00ebjtin CVE n\u00eb komponent\u00eb t\u00eb tjer\u00eb t\u00eb struktur\u00ebs Spring Framework, kurse CVE nuk ka lidhje me komponent\u00eb t\u00eb tjer\u00eb. N\u00eb k\u00ebt\u00eb rast do t\u00eb jet\u00eb nj\u00eb alarme false. <\/li>\n<\/ul>\n<p>\nObjekti i studimit \u00ebsht\u00eb projekti Open Source DVJA. N\u00eb studim mor\u00ebn pjes\u00eb vet\u00ebm komponent\u00ebt java (pa js).<\/p>\n<h3>P\u00ebrmbledhja e rezultateve<\/h3>\n<p>\nT\u00eb kalojm\u00eb menj\u00ebher\u00eb n\u00eb rezultatet e rishikimit manual t\u00eb dob\u00ebsive t\u00eb identifikuara. Me raportin e plot\u00eb p\u00ebr \u00e7do CVE mund t\u00eb njihemi n\u00eb Shtes\u00eb. <\/p>\n<p><i>P\u00ebrmbledhje e rezultateve p\u00ebr t\u00eb gjitha dob\u00ebsit\u00eb:<\/i><\/p>\n<p>Parametri<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Numri total i dob\u00ebsive t\u00eb identifikuara<br \/>\n42<br \/>\n91<br \/>\n51<\/p>\n<p>Dob\u00ebsi t\u00eb identifikuara gabimisht (false positive)<br \/>\n2(4.76%)<br \/>\n62(68,13%)<br \/>\n29(56.86%)<\/p>\n<p>Nuk jan\u00eb gjetur dob\u00ebsi relevante (false negative)<br \/>\n10<br \/>\n20<br \/>\n27<\/p>\n<p>\n<i>P\u00ebrmbledhje e rezultateve p\u00ebr komponent\u00ebt:<\/i><\/p>\n<p>Parametri<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<\/p>\n<p>Numri total i komponent\u00ebve t\u00eb identifikuar<br \/>\n62<br \/>\n47<br \/>\n59<\/p>\n<p>Numri total i komponent\u00ebve t\u00eb dob\u00ebt<br \/>\n16<br \/>\n13<br \/>\n10<\/p>\n<p>Komponent\u00eb t\u00eb dob\u00ebt t\u00eb identifikuar gabimisht (false positive)<br \/>\n1<br \/>\n5<br \/>\n0<\/p>\n<p>Komponent\u00eb t\u00eb dob\u00ebt t\u00eb identifikuar gabimisht (false positive)<br \/>\n0<br \/>\n6<br \/>\n6<\/p>\n<p>\nDo t\u00eb nd\u00ebrtojm\u00eb grafik\u00eb vizuale p\u00ebr t\u00eb vler\u00ebsuar raportin e false positive dhe false negative ndaj numrit total t\u00eb dob\u00ebsive. Komponent\u00ebt jan\u00eb sh\u00ebnuar horizontalisht, nd\u00ebrsa dob\u00ebsit\u00eb e identifikuara jan\u00eb sh\u00ebnuar vertikalisht. <\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/967b8e168383299d4a1bf4065f1905ca.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/2e128ee59e551894c25e4c9e28997008.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/585d7bcef052ef24e4de6c7e1a4e7c0b.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebr krahasim, nj\u00eb studim i ngjash\u00ebm \u00ebsht\u00eb kryer nga ekipi i Sonatype mbi testimin e nj\u00eb projekti me 1531 komponent\u00eb duke p\u00ebrdorur OWASP Dependency Check. Si\u00e7 mund ta shohim, raporti i zhurm\u00ebs ndaj goditjeve t\u00eb sakta \u00ebsht\u00eb n\u00eb p\u00ebrputhje me rezultatet tona.<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/286c34b84f1400af0285b711b3fe87f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>Burimi: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sonatype.com\/why-precision-matters-ebook\">www.sonatype.com\/why-precision-matters-ebook<\/a><\/noindex><\/i><\/p>\n<p>Le t\u00eb shqyrtojm\u00eb disa CVE nga rezultatet e skanimit ton\u00eb p\u00ebr t\u00eb kuptuar arsyen e k\u00ebtyre rezultateve.<\/p>\n<h3>M\u00eb shum\u00eb<\/h3>\n<p><\/p>\n<h4>\u21161<\/h4>\n<p>\nS\u00eb pari do t\u00eb shqyrtojm\u00eb disa pika interesante nga Sonatype Nexus IQ.<\/p>\n<p>Nexus IQ tregon nj\u00eb problem me deserealizimin me mund\u00ebsin\u00eb p\u00ebr t\u00eb kryer RCE n\u00eb Spring Framework disa her\u00eb. CVE-2016-1000027 n\u00eb spring-web:3.0.5 her\u00ebn e par\u00eb dhe CVE-2011-2894 n\u00eb spring-context:3.0.5 dhe spring-core:3.0.5. N\u00eb dukje duket se ka nj\u00eb p\u00ebrs\u00ebritje t\u00eb dob\u00ebsis\u00eb p\u00ebr disa CVE. N\u00ebse shikojm\u00eb CVE-2016-1000027 dhe CVE-2011-2894 n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave NVD, duket se gjith\u00e7ka \u00ebsht\u00eb e qart\u00eb.<\/p>\n<p>Komponenti<br \/>\nVulnerabiliteti<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>spring-core:3.0.5<br \/>\nCVE-2011-2894<\/p>\n<p>\nP\u00ebrshkrimi <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2011-2894\">CVE-2011-2894<\/a><\/noindex> nga NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/31b403eca6d7541c766c9a560bfbe6b7.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u00ebrshkrimi <noindex><a rel=\"nofollow\" href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2016-1000027\">CVE-2016-1000027<\/a><\/noindex> nga NVD:<br \/>\n<img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/d5b54a6ac15070b12f013eaacd2878f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCVE-2011-2894 \u00ebsht\u00eb mjaft e njohur. N\u00eb raportin <noindex><a rel=\"nofollow\" href=\"http:\/\/www.pwntester.com\/blog\/2013\/12\/16\/cve-2011-2894-deserialization-spring-rce\/\">White Source p\u00ebr vitin 2011<\/a><\/noindex> kjo CVE u pranuar si nj\u00eb nga m\u00eb t\u00eb zakonshmet. P\u00ebrshkrimet p\u00ebr CVE-2016-100027 n\u00eb p\u00ebrgjith\u00ebsi jan\u00eb t\u00eb pakta n\u00eb NVD, dhe duket se \u00ebsht\u00eb e aplikueshme vet\u00ebm p\u00ebr Spring Framework 4.1.4. Le t\u00eb shohim <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">referenc\u00eb<\/a><\/noindex> dhe k\u00ebtu b\u00ebhet gjith\u00e7ka m\u00eb e qart\u00eb. Nga <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/security\/research\/tra-2016-20\">artikulli Tenable<\/a><\/noindex> kuptojm\u00eb se p\u00ebrve\u00e7 dob\u00ebsis\u00eb n\u00eb <code>RemoteInvocationSerializingExporter<\/code> n\u00eb CVE-2011-2894, dob\u00ebsia v\u00ebrehet n\u00eb <code>HttpInvokerServiceExporter<\/code>. K\u00ebt\u00eb na e thot\u00eb Nexus IQ:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/a33f0853ce892d28eafafe2c8e7b2228.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nMegjithat\u00eb, nuk ka asgj\u00eb t\u00eb ngjashme n\u00eb NVD, p\u00ebr k\u00ebt\u00eb arsye, Dependency Check dhe Dependency Track marrin false negative.<\/p>\n<p>Po ashtu, nga p\u00ebrshkrimi i CVE-2011-2894 mund t\u00eb kuptohet se dob\u00ebsia n\u00eb t\u00eb v\u00ebrtet\u00eb ekziston dhe n\u00eb spring-context:3.0.5 dhe n\u00eb spring-core:3.0.5. Nj\u00eb konfirmim p\u00ebr k\u00ebt\u00eb mund t\u00eb gjendet n\u00eb artikullin nga ai q\u00eb e ka gjetur k\u00ebt\u00eb dob\u00ebsi.<\/p>\n<h4>\u21162<\/h4>\n<p><\/p>\n<p>Komponenti<br \/>\nVulnerabiliteti<br \/>\nRezultati<\/p>\n<p>struts2-core:2.3.30<br \/>\nCVE-2016-4003<br \/>\nFALSE<\/p>\n<p>\nN\u00ebse e studiojm\u00eb dob\u00ebsin\u00eb CVE-2016-4003, do t\u00eb kuptojm\u00eb se \u00ebsht\u00eb rregulluar q\u00eb n\u00eb versionin 2.3.28, megjithat\u00eb Nexus IQ na informon p\u00ebr t\u00eb. N\u00eb p\u00ebrshkrimin e dob\u00ebsis\u00eb ka nj\u00eb v\u00ebrejtje:<\/p>\n<p><img decoding=\"async\" alt=\"DevSecOps: parimet e funksionimit dhe krahasimi i SCA. Pjesa e par\u00eb\" src=\"\/wp-content\/uploads\/2020\/08\/081f9006748083727e424b709a338d60.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPra t\u00eb th\u00ebn\u00eb se dob\u00ebsia ekziston vet\u00ebm n\u00eb lidhje me versionin e vjet\u00ebruar t\u00eb JRE, p\u00ebr t\u00eb cilin na informuan. Megjithat\u00eb, ne e konsiderojm\u00eb k\u00ebt\u00eb si nj\u00eb False Positive, ndon\u00ebse nuk \u00ebsht\u00eb ndonj\u00eb gj\u00eb e r\u00ebnd\u00eb.<\/p>\n<h4>\u2116 3<\/h4>\n<p><\/p>\n<p>Komponenti<br \/>\nVulnerabiliteti<br \/>\nRezultati<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\nTRUE<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-7672<br \/>\nFALSE<\/p>\n<p>\nN\u00ebse shikojm\u00eb p\u00ebrshkrimin e CVE-2017-9804 dhe CVE-2017-7672, do ta kuptojm\u00eb se problemi q\u00ebndron n\u00eb <code>klas\u00ebn URLValidator<\/code>, meq\u00eb CVE-2017-9804 buron nga CVE-2017-7672. Prania e dob\u00ebsis\u00eb s\u00eb dyt\u00eb nuk ofron asnj\u00eb vler\u00eb t\u00eb dobishme p\u00ebrve\u00e7 rritjes s\u00eb severitetit n\u00eb High, ndaj mund ta konsiderojm\u00eb k\u00ebt\u00eb si zhurm\u00eb t\u00eb tep\u00ebrt.<\/p>\n<p>N\u00eb p\u00ebrgjith\u00ebsi, nuk u gjet\u00ebn false positive t\u00eb tjera p\u00ebr Nexus IQ.<\/p>\n<h3>\u21164<\/h3>\n<p>\nKa disa aspekte q\u00eb e ve\u00e7ojn\u00eb IQ nga zgjidhjet e tjera.<\/p>\n<p>Komponenti<br \/>\nVulnerabiliteti<br \/>\nRezultati<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2020-5398<br \/>\nTRUE<\/p>\n<p>CVE n\u00eb NVD raporton se \u00ebsht\u00eb e aplikueshme vet\u00ebm p\u00ebr versionet 5.2.x deri n\u00eb 5.2.3, 5.1.x deri n\u00eb 5.1.13, dhe versionet 5.0.x deri n\u00eb 5.0.16, megjithat\u00eb, n\u00ebse shikojm\u00eb p\u00ebrshkrimin e CVE n\u00eb Nexus IQ, do t\u00eb shohim se:<br \/>\n<i>Njoftimi p\u00ebr devijimin nga k\u00ebshilla: Ekipi i k\u00ebrkimeve p\u00ebr sigurin\u00eb n\u00eb Sonatype zbuloi se kjo dob\u00ebsi u fut n\u00eb versionin 3.0.2.RELEASE dhe jo 5.0.x si\u00e7 u tha n\u00eb njoftim.<\/i><\/p>\n<p>Pas k\u00ebsaj vjen PoC p\u00ebr k\u00ebt\u00eb dob\u00ebsi, e cila raportonn se ajo \u00ebsht\u00eb e pranishme n\u00eb versionin 3.0.5.<\/p>\n<p>False negative d\u00ebrgohet te Dependency Check dhe Dependency Track.<\/p>\n<h3>\u21165<\/h3>\n<p>\nT\u00eb shohim p\u00ebr false positive p\u00ebr Dependency Check dhe Dependency Track.<\/p>\n<p>Dependency Check ve\u00e7ohet p\u00ebr faktin se pasqyron ato CVE q\u00eb i p\u00ebrkasin t\u00eb gjith\u00eb frameworkut n\u00eb NVD, n\u00eb ato komponent\u00eb p\u00ebr t\u00eb cilat k\u00ebto CVE nuk jan\u00eb t\u00eb aplikueshme. Kjo ka t\u00eb b\u00ebj\u00eb me CVE-2012-0394, CVE-2013-2115, CVE-2014-0114, CVE-2015-0899, CVE-2015-2992, CVE-2016-1181, CVE-2016-1182, t\u00eb cilat Dependency Check \"ka lidhur\" me struts-taglib:1.3.8 dhe struts-tiles-1.3.8. K\u00ebto komponent\u00eb nuk kan\u00eb asgj\u00eb t\u00eb p\u00ebrbashk\u00ebt me at\u00eb q\u00eb p\u00ebrshkruhet n\u00eb CVE \u2014 p\u00ebrpunimi i k\u00ebrkesave, validimi i faqeve dhe k\u00ebshtu me radh\u00eb. Kjo \u00ebsht\u00eb p\u00ebr shkak se ajo q\u00eb kan\u00eb t\u00eb p\u00ebrbashk\u00ebt k\u00ebto CVE dhe komponent\u00ebt \u00ebsht\u00eb vet\u00ebm frameworku, p\u00ebr shkak t\u00eb s\u00eb cil\u00ebs Dependency Check e konsideroi k\u00ebt\u00eb si nj\u00eb dob\u00ebsi.<\/p>\n<p>E nj\u00ebjta situat\u00eb \u00ebsht\u00eb me spring-tx:3.0.5, dhe nj\u00eb situat\u00eb e ngjashme me struts-core:1.3.8. P\u00ebr struts-core, Dependency Check dhe Dependency Track gjet\u00ebn shum\u00eb dob\u00ebsi, t\u00eb cilat n\u00eb t\u00eb v\u00ebrtet\u00eb jan\u00eb t\u00eb aplikueshme p\u00ebr struts2-core, q\u00eb n\u00eb thelb \u00ebsht\u00eb nj\u00eb framework i ve\u00e7ant\u00eb. N\u00eb k\u00ebt\u00eb rast, Nexus IQ e kuptoi sakt\u00ebsisht situat\u00ebn dhe n\u00eb ato CVE q\u00eb l\u00ebshoi, tregoi se struts-core kishte kaluar n\u00eb fund t\u00eb jet\u00ebs dhe duhej t\u00eb kalonte te struts2-core.<\/p>\n<h3>\u21166<\/h3>\n<p>\nN\u00eb disa raste, interpretimi i nj\u00eb gabimi t\u00eb qart\u00eb nga Dependency Check dhe Dependency Track \u00ebsht\u00eb i padrejt\u00eb. N\u00eb ve\u00e7anti, CVE-2013-4152, CVE-2013-6429, CVE-2013-6430, CVE-2013-7315, CVE-2014-0054, CVE-2014-0225, CVE-2014-0225, t\u00eb cilat Dependency Check dhe Dependency Track i kan\u00eb lidhur me spring-core:3.0.5, n\u00eb t\u00eb v\u00ebrtet\u00eb i p\u00ebrkasin spring-web:3.0.5. Disa nga k\u00ebto CVE jan\u00eb identifikuar gjithashtu nga Nexus IQ, megjithat\u00eb IQ i ka identifikuar ato sakt\u00ebsisht me nj\u00eb komponent tjet\u00ebr. Fakti q\u00eb k\u00ebto cenueshm\u00ebri nuk jan\u00eb gjetur n\u00eb spring-core, nuk do t\u00eb thot\u00eb se ato nuk ekzistojn\u00eb n\u00eb kuad\u00ebr t\u00eb framework-ut n\u00eb p\u00ebrgjith\u00ebsi dhe mjetet open source me vendosm\u00ebri e kan\u00eb theksuar ekzistenc\u00ebn e k\u00ebtyre cenueshm\u00ebrive (thjesht kan\u00eb b\u00ebr\u00eb nj\u00eb gabim t\u00eb vog\u00ebl). <\/p>\n<h3>P\u00ebrfundimet<\/h3>\n<p>\nSi\u00e7 mund ta shohim, p\u00ebrcaktimi i sakt\u00ebsis\u00eb s\u00eb cenueshm\u00ebrive t\u00eb zbuluara me nj\u00eb rishikim manual nuk jep rezultate t\u00eb qarta, duke krijuar k\u00ebshtu momente t\u00eb kontestueshme. Rezultatet tregojn\u00eb se zgjidhja Nexus IQ ka nivelin m\u00eb t\u00eb ul\u00ebt t\u00eb goditjeve false dhe sakt\u00ebsin\u00eb m\u00eb t\u00eb lart\u00eb. <\/p>\n<p>N\u00eb radh\u00eb t\u00eb par\u00eb, kjo lidhet me faktin se ekipi i Sonatype ka zgjeruar p\u00ebrshkrimin p\u00ebr \u00e7do cenueshm\u00ebri CVE nga NVD n\u00eb bazat e tyre, duke treguar me sakt\u00ebsi deri n\u00eb klas\u00eb ose funksion t\u00eb cenueshm\u00ebris\u00eb p\u00ebr versionet e caktuara t\u00eb komponent\u00ebve, duke kryer studime shtes\u00eb (p.sh., duke kontrolluar cenueshm\u00ebrit\u00eb n\u00eb versionet m\u00eb t\u00eb vjetra t\u00eb softuerit). <\/p>\n<p>Nj\u00eb ndikim t\u00eb r\u00ebnd\u00ebsish\u00ebm n\u00eb rezultatet ka edhe ato cenueshm\u00ebri q\u00eb nuk kan\u00eb arritur n\u00eb NVD, por megjithat\u00eb jan\u00eb t\u00eb pranishme n\u00eb baz\u00ebn e t\u00eb dh\u00ebnave t\u00eb Sonatype me sh\u00ebnimin SONATYPE. Sipas raportit <noindex><a rel=\"nofollow\" href=\"https:\/\/www.whitesourcesoftware.com\/open-source-vulnerability-management-report\/\">Gjendja e Dob\u00ebsive t\u00eb Siguris\u00eb n\u00eb Open Source 2020<\/a><\/noindex> rreth 45% e cenueshm\u00ebrive me burim t\u00eb hapur nuk raportohen n\u00eb NVD. Sipas baz\u00ebs s\u00eb t\u00eb dh\u00ebnave WhiteSource, vet\u00ebm 29% e t\u00eb gjitha cenueshm\u00ebrive me burim t\u00eb hapur, t\u00eb regjistruara jasht\u00eb NVD, p\u00ebrfundojn\u00eb n\u00eb at\u00eb, prandaj kaq e r\u00ebnd\u00ebsishme \u00ebsht\u00eb t\u00eb k\u00ebrkohen cenueshm\u00ebrit\u00eb gjithashtu n\u00eb burime t\u00eb tjera.<\/p>\n<p>Si rezultat, Dependency Check jep nj\u00eb sasi t\u00eb madhe zhurmash, duke humbur nj\u00eb pjes\u00eb t\u00eb komponent\u00ebve t\u00eb cenuesh\u00ebm. Dependency Track jep m\u00eb pak zhurma dhe identifikon nj\u00eb num\u00ebr t\u00eb madh komponent\u00ebsh, \u00e7ka nuk d\u00ebmton syrit n\u00eb nd\u00ebrfaqen e uebit.<\/p>\n<p>Megjithat\u00eb, praktika tregon se open source duhet t\u00eb jet\u00eb hapi i par\u00eb drejt nj\u00eb DevSecOps t\u00eb zhvilluar. E para q\u00eb duhet t\u00eb mendohet p\u00ebr integrimin e SCA n\u00eb zhvillim \u2014 jan\u00eb proceset, pra diskutimet me menaxhimin dhe departamentet e tjera mbi se si duhet t\u00eb duken proceset ideale n\u00eb organizat\u00ebn tuaj. Mund t\u00eb ndodh\u00eb q\u00eb p\u00ebr organizat\u00ebn tuaj, n\u00eb fillim, Dependency Check ose Dependency Track do t\u00eb p\u00ebrmbushin t\u00eb gjitha nevojat e biznesit, nd\u00ebrsa zgjidhjet Enterprise do t\u00eb jen\u00eb nj\u00eb vazhdim logjik p\u00ebr shkak t\u00eb rritjes s\u00eb kompleksitetit t\u00eb aplikacioneve q\u00eb zhvillohen.<\/p>\n<p>                        <b class=\"spoiler_title\">Aplikimi A. Rezultatet p\u00ebr komponent\u00ebt<\/b><br \/>\n                        <b>Simbolet:<\/b><\/p>\n<ul>\n<li>High \u2014 vulnerabilitete n\u00eb nivel t\u00eb lart\u00eb dhe kritik n\u00eb komponent<\/li>\n<li>Medium \u2014 vulnerabilitete me mesatare r\u00ebnd\u00ebsi n\u00eb komponent<\/li>\n<li>TRUE \u2014 Vulnerabilitet i identifikuar sakt\u00eb (issue True positive)<\/li>\n<li>FALSE \u2014 Alarm i rrem\u00eb (issue False positive)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponenti<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nRezultati<\/p>\n<p>dom4j: 1.6.1<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>commons-codec:1:10<br \/>\nMesatar<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nI Lart\u00eb<br \/>\nkomponenti nuk u gjet<\/p>\n<p>TRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nI Lart\u00eb<br \/>\nkomponenti nuk u gjet<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nMesatar<br \/>\nkomponenti nuk u gjet<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\nMesatar<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nMesatar<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-core:1.3.8<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>xwork-core: 2.3.30<br \/>\nI Lart\u00eb<br \/>\n\u2014<br \/>\n\u2014<br \/>\nTRUE<\/p>\n<p>struts2-core: 2.3.30<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\n\u2014<br \/>\nFALSE<\/p>\n<p><\/p>\n<p>                        <b class=\"spoiler_title\">Aplikimi B. Rezultatet p\u00ebr vulnerabilitetet<\/b><br \/>\n                        <b>Simbolet:<\/b><\/p>\n<ul>\n<li>High \u2014 vulnerabilitete n\u00eb nivel t\u00eb lart\u00eb dhe kritik n\u00eb komponent<\/li>\n<li>Medium \u2014 vulnerabilitete me mesatare r\u00ebnd\u00ebsi n\u00eb komponent<\/li>\n<li>TRUE \u2014 Vulnerabilitet i identifikuar sakt\u00eb (issue True positive)<\/li>\n<li>FALSE \u2014 Alarm i rrem\u00eb (issue False positive)<\/li>\n<\/ul>\n<p><\/p>\n<p>Komponenti<br \/>\nNexus IQ<br \/>\nDependency Check<br \/>\nDependency Track<br \/>\nSeverity<br \/>\nRezultati<br \/>\nKoment<\/p>\n<p>dom4j: 1.6.1<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nCVE-2018-1000632<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nCVE-2020-10683<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>log4j-core: 2.3<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nCVE-2017-5645<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nCVE-2020-9488<br \/>\nI Ul\u00ebt<br \/>\nTRUE<\/p>\n<p>log4j: 1.2.14<br \/>\nCVE-2019-17571<br \/>\nCVE-2019-17571<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-9488<br \/>\n\u2014<br \/>\nI Ul\u00ebt<br \/>\nTRUE<\/p>\n<p>SONATYPE-2010-0053<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>commons-collections:3.1<br \/>\n\u2014<br \/>\nCVE-2015-6420<br \/>\nCVE-2015-6420<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nDuplicon RCE(OSSINDEX)<\/p>\n<p>\u2014<br \/>\nCVE-2017-15708<br \/>\nCVE-2017-15708<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nDuplicon RCE(OSSINDEX)<\/p>\n<p>SONATYPE-2015-0002<br \/>\nRCE (OSSINDEX)<br \/>\nRCE(OSSINDEX)<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>commons-fileupload:1.3.2<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nCVE-2016-1000031<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>SONATYPE-2014-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>commons-beanutils:1.7.0<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2019-10086<br \/>\nCVE-2019-10086<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti \u00ebsht\u00eb i zbatuesh\u00ebm vet\u00ebm p\u00ebr versionet 1.9.2+<\/p>\n<p>commons-codec:1:10<br \/>\nSONATYPE-2012-0050<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>mysql-connector-java:5.1.42<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nCVE-2018-3258<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2019-2692<br \/>\nCVE-2019-2692<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2020-2875<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nT\u00eb nj\u00ebjtin vulnerabilitet si CVE-2019-2692, por me sh\u00ebnimin \"sulmet mund t\u00eb ndikojn\u00eb ndjesh\u00ebm n\u00eb produkte t\u00eb tjera\"<\/p>\n<p>\u2014<br \/>\nCVE-2017-15945<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk p\u00ebrfshihet n\u00eb mysql-connector-java<\/p>\n<p>\u2014<br \/>\nCVE-2020-2933<br \/>\n\u2014<br \/>\nI Ul\u00ebt<br \/>\nFALSE<br \/>\nDuplicon n\u00eb CVE-2020-2934<\/p>\n<p>CVE-2020-2934<br \/>\nCVE-2020-2934<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>spring-expression:3.0.5<br \/>\nCVE-2018-1270<br \/>\nkomponenti nuk u gjet<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2018-1257<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>spring-web:3.0.5<br \/>\nCVE-2016-1000027<br \/>\nkomponenti nuk u gjet<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2014-0225<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2011-2730<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>CVE-2018-1272<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2020-5398<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<br \/>\nNj\u00eb shembull i qart\u00eb n\u00eb favor t\u00eb IQ: \"Ekipi i k\u00ebrkimeve n\u00eb siguri t\u00eb Sonatype zbuloi se ky vulnerabilitet u prezantua n\u00eb versionin 3.0.2.RELEASE dhe jo 5.0.x si\u00e7 thuhet n\u00eb paralajm\u00ebrim.\"<\/p>\n<p>CVE-2013-6429<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>CVE-2014-0054<br \/>\n\u2014<br \/>\nCVE-2014-0054<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>CVE-2013-6430<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>spring-context:3.0.5<br \/>\nCVE-2011-2894<br \/>\nkomponenti nuk u gjet<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>spring-core:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\nCVE-2011-2730<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nCVE-2011-2894<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2013-4152<br \/>\nMesatar<br \/>\nFALSE<br \/>\nDuplicon k\u00ebt\u00eb vulnerabilitet n\u00eb spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\nCVE-2013-6429<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\nCVE-2013-7315<br \/>\nMesatar<br \/>\nFALSE<br \/>\nSPLIT nga CVE-2013-4152. + Vulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\nCVE-2014-0054<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2014-0225<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nDuplicon k\u00ebt\u00eb vulnerabilitet n\u00eb spring-web<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\nCVE-2014-1904<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\nCVE-2014-3625<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\nCVE-2016-9878<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\nCVE-2018-1270<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nP\u00ebr spring-expression \/ spring-messages<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\nCVE-2018-1271<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti i p\u00ebrket komponentit spring-web-mvc<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\nCVE-2018-1272<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2014-3578<br \/>\nCVE-2014-3578 (OSSINDEX)<br \/>\nCVE-2014-3578<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>SONATYPE-2015-0327<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Ul\u00ebt<br \/>\nTRUE<\/p>\n<p>struts2-config-browser-plugin:2.3.30<br \/>\nSONATYPE-2016-0104<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nTRUE<\/p>\n<p>spring-tx:3.0.5<br \/>\n\u2014<br \/>\nCVE-2011-2730<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2011-2894<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-4152<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6429<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-6430<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2013-7315<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0054<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-0225<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-1904<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2014-3625<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2016-9878<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1270<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1271<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>\u2014<br \/>\nCVE-2018-1272<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabiliteti nuk p\u00ebrfshihet n\u00eb spring-tx<\/p>\n<p>struts-core:1.3.8<br \/>\n\u2014<br \/>\nCVE-2011-5057 (OSSINDEX)<\/p>\n<p>Mesatar<br \/>\nFASLE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0391 (OSSINDEX)<br \/>\nCVE-2012-0391<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0094 (OSSINDEX)<br \/>\nCVE-2014-0094<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2014-0113 (OSSINDEX)<br \/>\nCVE-2014-0113<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>CVE-2016-1182<br \/>\n3VE-2016-1182<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\n\u2014<br \/>\nCVE-2011-5057<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0392 (OSSINDEX)<br \/>\nCVE-2012-0392<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0393 (OSSINDEX)<br \/>\nCVE-2012-0393<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>CVE-2015-0899<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2012-0394<br \/>\nCVE-2012-0394<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2012-0838 (OSSINDEX)<br \/>\nCVE-2012-0838<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1965 (OSSINDEX)<br \/>\nCVE-2013-1965<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-1966 (OSSINDEX)<br \/>\nCVE-2013-1966<br \/>\nI Lart\u00eb<br \/>\nFASLE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\nCVE-2013-2115<br \/>\nI Lart\u00eb<br \/>\nFASLE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2134 (OSSINDEX)<br \/>\nCVE-2013-2134<br \/>\nI Lart\u00eb<br \/>\nFASLE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2013-2135 (OSSINDEX)<br \/>\nCVE-2013-2135<br \/>\nI Lart\u00eb<br \/>\nFASLE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>CVE-2014-0114<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\nCVE-2015-2992<br \/>\nMesatar<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>\u2014<br \/>\nCVE-2016-0785 (OSSINDEX)<br \/>\nCVE-2016-0785<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>CVE-2016-1181<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2016-4003 (OSSINDEX)<br \/>\nCVE-2016-4003<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nVulnerabilitet n\u00eb Struts 2<\/p>\n<p>xwork-core:2.3.30<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>SONATYPE-2017-0173<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2017-7672<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nDublim p\u00ebr CVE-2017-9804<\/p>\n<p>SONATYPE-2016-0127<br \/>\n\u2014<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>struts2-core:2.3.30<br \/>\n\u2014<br \/>\nCVE-2016-6795<br \/>\nCVE-2016-6795<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9787<br \/>\nCVE-2017-9787<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9791<br \/>\nCVE-2017-9791<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9793<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nDublim p\u00ebr CVE-2018-1327<\/p>\n<p>\u2014<br \/>\nCVE-2017-9804<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>\u2014<br \/>\nCVE-2017-9805<br \/>\nCVE-2017-9805<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2016-4003<br \/>\n\u2014<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nI aplikuesh\u00ebm p\u00ebr Apache Struts 2.x deri n\u00eb 2.3.28, dhe kjo \u00ebsht\u00eb versioni 2.3.30. Megjithat\u00eb, sipas p\u00ebrshkrimit, CVE vepron p\u00ebr \u00e7do version t\u00eb Struts 2, n\u00ebse p\u00ebrdoret JRE 1.7 dhe m\u00eb pak. Duket se k\u00ebtu kan\u00eb dashur t\u00eb mbrohen, por duket m\u00eb shum\u00eb si FALSE.<\/p>\n<p>\u2014<br \/>\nCVE-2018-1327<br \/>\nCVE-2018-1327<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nCVE-2017-5638<br \/>\nI Lart\u00eb<br \/>\nTRUE<br \/>\nAjo vulnerabilitet, t\u00eb cilin e shfryt\u00ebzuan hacker\u00ebt n\u00eb Equifax n\u00eb vitin 2017<\/p>\n<p>CVE-2017-12611<br \/>\nCVE-2017-12611<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>CVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nCVE-2018-11776<br \/>\nI Lart\u00eb<br \/>\nTRUE<\/p>\n<p>struts-taglib:1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nP\u00ebr struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nP\u00ebr struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nP\u00ebr commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket taglib<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nI p\u00ebrket struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket taglib<\/p>\n<p>struts-tiles-1.3.8<br \/>\n\u2014<br \/>\nCVE-2012-0394<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nP\u00ebr struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2013-2115<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nP\u00ebr struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2014-0114<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nN\u00ebn commons-beanutils<\/p>\n<p>\u2014<br \/>\nCVE-2015-0899<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket tiles<\/p>\n<p>\u2014<br \/>\nCVE-2015-2992<br \/>\n\u2014<br \/>\nMesatar<br \/>\nFALSE<br \/>\nP\u00ebr struts2-core<\/p>\n<p>\u2014<br \/>\nCVE-2016-1181<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket taglib<\/p>\n<p>\u2014<br \/>\nCVE-2016-1182<br \/>\n\u2014<br \/>\nI Lart\u00eb<br \/>\nFALSE<br \/>\nNuk i p\u00ebrket taglib<\/p>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/post\/516660\/\">habr.com<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b. Software Composition Analysis \u2014 SCA) \u0432 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u043a\u0438 \u0440\u0430\u0441\u0442\u0435\u0442 \u043f\u043e \u043c\u0435\u0440\u0435 \u0432\u044b\u0445\u043e\u0434\u0430 \u0435\u0436\u0435\u0433\u043e\u0434\u043d\u044b\u0445 \u043e\u0442\u0447\u0435\u0442\u043e\u0432 \u043e\u0431 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u0445 open source \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u0443\u0431\u043b\u0438\u043a\u0443\u044e\u0442\u0441\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f\u043c\u0438 Synopsys, Sonatype, Snyk, White Source. \u0421\u043e\u0433\u043b\u0430\u0441\u043d\u043e \u043e\u0442\u0447\u0435\u0442\u0443 The State of Open Source Security Vulnerabilities 2020 \u0447\u0438\u0441\u043b\u043e \u0432\u044b\u044f\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 open source \u0432 2019 \u0432\u044b\u0440\u043e\u0441\u043b\u043e \u043f\u043e\u0447\u0442\u0438 \u0432 1.5 [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":92520,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-92519","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2020-08-28T05:42:26+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd47DevSecOps: parimet e pun\u00ebs dhe krahasimi SCA. Pjesa e par\u00eb | ProHoster","description":"R\u00ebnd\u00ebsia e analiz\u00ebs s\u00eb komponent\u00ebve t\u00eb jasht\u00ebm t\u00eb softuer\u00ebve (angl.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47DevSecOps: \u043f\u0440\u0438\u043d\u0446\u0438\u043f\u044b \u0440\u0430\u0431\u043e\u0442\u044b \u0438 \u0441\u0440\u0430\u0432\u043d\u0435\u043d\u0438\u0435 SCA. \u0427\u0430\u0441\u0442\u044c \u043f\u0435\u0440\u0432\u0430\u044f | ProHoster","og:description":"\u0417\u043d\u0430\u0447\u0438\u043c\u043e\u0441\u0442\u044c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u041f\u041e (\u0430\u043d\u0433\u043b.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-08-28T05:42:26+00:00","article:modified_time":"2020-08-28T05:42:26+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"92519","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 12:06:40","updated":"2022-10-01 01:38:08","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/92519","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=92519"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/92519\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/92520"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=92519"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=92519"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=92519"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}