Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

R24.08 Security Checks #369

Closed
evegufy opened this issue Jul 16, 2024 · 1 comment
Closed

R24.08 Security Checks #369

evegufy opened this issue Jul 16, 2024 · 1 comment
Assignees
@oyo @ntruchsess @Phil91 @evegufy
Milestone
Release 2.1.0 (24...

Comments

@evegufy
Copy link
Contributor

evegufy commented Jul 16, 2024 •
edited
Loading

Execute security checks with focus R24.08.

Relevant repos to check:

To be analysed and upgraded in all "backend" repos:

System.Text.Json needs to be upgraded from 8.0.0 to 8.0.4
@evegufy evegufy self-assigned this Jul 16, 2024
@evegufy evegufy added this to Portal Jul 16, 2024
@github-project-automation github-project-automation bot moved this to NEW USER REQUEST in Portal Jul 16, 2024
@evegufy evegufy moved this from NEW USER REQUEST to IN PROGRESS in Portal Jul 16, 2024
This was referenced Jul 20, 2024
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Merged
Closed
Closed
@evegufy evegufy added this to the Release 2.1.0 (24.08) milestone Jul 20, 2024
@evegufy evegufy mentioned this issue Jul 20, 2024
Closed
This was referenced Jul 22, 2024
Merged
Merged
Merged
Merged
Merged
evegufy pushed a commit to eclipse-tractusx/policy-hub that referenced this issue Jul 25, 2024
@ntruchsess
chore(dependencies): bump efcore to 8.0.7 (#175)
27cb2e0 
eclipse-tractusx/portal#369
evegufy pushed a commit to eclipse-tractusx/ssi-credential-issuer that referenced this issue Jul 25, 2024
@ntruchsess
chore(dependencies): bump efcore to 8.0.7 (#214)
5f8358f 
eclipse-tractusx/portal#369
@evegufy
Copy link
Contributor Author

evegufy commented Jul 25, 2024

Hi @ntruchsess eclipse-tractusx/ssi-credential-issuer#214 and eclipse-tractusx/policy-hub#175 were only partially solving the issue, still open are the following:
https://github.com/eclipse-tractusx/ssi-credential-issuer/security/code-scanning/434
https://github.com/eclipse-tractusx/policy-hub/security/code-scanning/269

Please also the the other repos, if you did forget some other places.

evegufy added a commit to eclipse-tractusx/portal-backend that referenced this issue Jul 26, 2024
@dependabot @evegufy
build(deps): bump MimeKit from 4.3.0 to 4.7.1 (#833)
c304803 
eclipse-tractusx/portal#369

* build(deps): bump MimeKit from 4.3.0 to 4.7.1 in /tests/endtoend

Bumps MimeKit from 4.3.0 to 4.7.1.

---
updated-dependencies:
- dependency-name: MimeKit
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

* chore: upgrade mimekit in sendmail project

* chore: update dependencies file

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evelyn Gurschler <[email protected]>
@ntruchsess ntruchsess mentioned this issue Jul 26, 2024
Merged
4 tasks
This was referenced Jul 26, 2024
Merged
Merged
Merged
ntruchsess pushed a commit to eclipse-tractusx/portal-backend that referenced this issue Jul 29, 2024
@dependabot @evegufy @ntruchsess
build(deps): bump MimeKit from 4.3.0 to 4.7.1 (#833)
b19380f 
eclipse-tractusx/portal#369

* build(deps): bump MimeKit from 4.3.0 to 4.7.1 in /tests/endtoend

Bumps MimeKit from 4.3.0 to 4.7.1.

---
updated-dependencies:
- dependency-name: MimeKit
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <[email protected]>

* chore: upgrade mimekit in sendmail project

* chore: update dependencies file

---------

Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evelyn Gurschler <[email protected]>
@ntruchsess ntruchsess mentioned this issue Jul 29, 2024
Merged
3 tasks
ntruchsess added a commit to eclipse-tractusx/portal-backend that referenced this issue Jul 29, 2024
@ntruchsess
Merge pull request #884 from eclipse-tractusx/chore/merge_to_main
9dfa228 
* fix(apps): remove leading '/' from the activate subscription endpoint (#861)
Refs: #856
* bug(offersubscription): suppress activation of external serviceaccounts in keycloak on subscription-activation (#864)
Refs: #856
* fix(dim): fix callback logic for dim requests (#863)
Refs: #862
chore(dependencies): bump efcore to 8.0.7 (#857)
* increase efcore version to latest 8.0.7 to resolve security-issue in transitive dependency in System.Text.Json
* fix(offersubscription): skip optional autosetupprovidercallback  if it is not configured (#865)
* add clientPrefix  to workers appsettings (#870)
* fix: enhance subscription/provider endpoint with external Service data (#867)
Refs: #841
* fix(sdDoc): set process step to skipped if ClearinghouseConnectDisabled is true (#874)
Refs: #792
* build(deps): bump MimeKit from 4.3.0 to 4.7.1 (#833)
eclipse-tractusx/portal#369
* build(deps): bump MimeKit from 4.3.0 to 4.7.1 in /tests/endtoend
Bumps MimeKit from 4.3.0 to 4.7.1.
---
updated-dependencies:
- dependency-name: MimeKit
  dependency-type: direct:production
...
* chore: upgrade mimekit in sendmail project
* chore: update dependencies file
---------
* upgrade implicit dependencies on System.Text.Json (#875)
* Serilog.Settings.Configuration to 8.0.2
* remove redundant dependencies on Microsoft.Extensions.Hosting
* bump framework version to 2.4.2 after merge of main
---------
Signed-off-by: dependabot[bot] <[email protected]>
Co-authored-by: Norbert Truchsess <[email protected]>
Co-authored-by: Phil Schneider <[email protected]>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Evelyn Gurschler <[email protected]>
Reviewed-By: Evelyn Gurschler <[email protected]>
Reviewed-By: Norbert Truchsess <[email protected]>
Reviewed-By: Phil Schneider <[email protected]>
@evegufy evegufy closed this as completed Jul 29, 2024
@github-project-automation github-project-automation bot moved this from IN PROGRESS to USER READY in Portal Jul 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@oyo oyo

@ntruchsess ntruchsess

@Phil91 Phil91

@evegufy evegufy

Labels
None yet
Projects
Portal
Archived in project
Milestone
Release 2.1.0 (24.08)
Development

No branches or pull requests
4 participants
@oyo @ntruchsess @Phil91 @evegufy