search

bcgov / itvr

Apache License 2.0
2 stars 8 forks source link

ITVR - Security Scan Report Review (Penetration Testing) #621

Open kcabhar opened 5 months ago

kcabhar commented 5 months ago

Problem Description In order to (achieve some goal), (a system or persona) needs to (some action).

Solution Needs

Timebox

Outcome Details describing the outcome of the research

Additional Context

kuanfandevops commented 5 months ago

Eliminated the frontend critical Vulnerability Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol by replacing base image Node 16 with Node 20 It also resolved the following Fixable Severity at least Important:

kuanfandevops commented 5 months ago

The critical policy violation: Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol This violation appears on both backend and taskq deployment. The bases image has been updated to the latest ubi9/python-311 tag 1-41. According to the image https://catalog.redhat.com/software/containers/ubi9/python-311/63f764b03f0b02a2e2d63fff?architecture=amd64&image=657169cb02ee638f42e72f43&container-tabs=security, this image does not have any unapplied Critical or Important security updates, but it didn;t resolve the issue. This image is the latest and the most reloable base image for Openshift we can find. We will need to wait for RedHat to release a newer version.

kuanfandevops commented 5 months ago
Screenshot 2024-01-18 at 11.01.08 AM.png

Added the ZAP Scan step to our pipeline, it scans public available URLs on ITVR Dev for each build. A sample of scan report for frontend dev url is attached. zap_scan.zip

kuanfandevops commented 5 months ago

A Zap Baseline scan step has been added to dev build pipeline. The baseline scan report is created automatically for each build on Dev.

kuanfandevops commented 5 months ago

A Zap Full scan pipeline has been created. It can do the full scan for both dev and test upon approval.

kuanfandevops commented 5 months ago

Plan to use the object storage to replace Minio. Then Minio can be removed and the related vulnerabilities will disappear.

kuanfandevops commented 5 months ago

Tried to use the latest ClamAV image, but it didn't eliminate the violation "Rapid Reset: Denial of Service Vulnerability in HTTP/2 Protocol". Will need to wait ClamAV to upgrade their image.

kuanfandevops commented 1 month ago

Developers started to merge the pull requests auomatically created by GitHub Bot.

ArawuSamuel1 commented 4 weeks ago

Hi @kuanfandevops is this ticket in flight? as it has been in about 8 sprints since Jan 11, 2024

If it's on flight, @shayjeff how do we account for the story points in our velocity?

shayjeff commented 3 weeks ago

@ArawuSamuel1 - this is an ongoing card that Kuan works on. We don't usually count it towards our velocity unless Kuan specifies that the dev's need to do some work on it. If that is the case we will estimate the card based on what the dev's need to work on.

ArawuSamuel1 commented 3 weeks ago

Great, thanks for letting me know.

Best Regards, Samuel Arawu, PMP, PSM, ICP-ACC, SPC 6.0, PSPO, ITIL Snr. Scrum Master, Natural Resource Information & Digital Services Division, Ministry of Land, Water and Resource Stewardship.

From: shayjeff @.> Sent: Wednesday, June 5, 2024 1:23 PM To: bcgov/itvr @.> Cc: Arawu, Samuel WLRS:EX @.>; Mention @.> Subject: Re: [bcgov/itvr] ITVR - Security Scan Report Review (Penetration Testing) (Issue #621)

You don't often get email from @.*** Learn why this is importanthttps://aka.ms/LearnAboutSenderIdentification

[EXTERNAL] This email came from an external source. Only open attachments or links that you are expecting from a known sender.

@ArawuSamuel1https://github.com/ArawuSamuel1 - this is an ongoing card that Kuan works on. We don't usually count it towards our velocity unless Kuan specifies that the dev's need to do some work on it. If that is the case we will estimate the card based on what the dev's need to work on.

— Reply to this email directly, view it on GitHubhttps://github.com/bcgov/itvr/issues/621#issuecomment-2150902270, or unsubscribehttps://github.com/notifications/unsubscribe-auth/ASACEJZBMGKACDY4DSQLWILZF5XUHAVCNFSM6AAAAABBW7F3LSVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDCNJQHEYDEMRXGA. You are receiving this because you were mentioned.Message ID: @.***>