v4.0.0 #1751

v4.0.0

This release has been a long time in the making and brings some awesome improvements to the system as a whole and the auto-discovery in general. Some of these changes required some minor breaking changes, you can find a sumamry of the most important breaking changes in the "💣 Breaking Changes" section below and a complete and detailed list in the Upgrading from 3.x - 4.x notes.

🚀 Features

• Allow multiple scanTypes to be used in the Service and Container AutoDiscovery @Ilyesbdlala (Allow multiple scantypes to be used in the service and container autodiscovery (closes #1384) #1447)
• Add Cluster Wide Custom Resources (ClusterScanType, ClusterParseDefinition & ClusterScanCompletionHook) @J12934 (Feature ADR 12 - Cluster Wide Custom Resources #1662): See more in ADR-12
• Enable Container AutoDiscovery to scan images from private repos @the-simmon (ADR 17: Enable container autodiscovery to scan images from private repos #1374, Enable ContainerAutodiscovery to scan images from private repos (ADR 17)(closes #1189) #1557): See more in ADR-17
• Added new references attribute to the finding format with unified references to CVEs, CWEs and other external references @Ilyesbdlala (Added references attribute to findings #1676)
• Added optional identified at parameter to findings (for all scanners which include this info in their results) @Ilyesbdlala (Added optional identified at parameter to findings #1434)
• Added new DNS Scanner: Doggo @rseedorff (Added new DNS Scanner: Doggo #1446)
• Added option to specify a go template to configure where in the s3 bucket the result files (raw scanner results and findings.json) should be stored. @the-simmon & @J12934 (Generate S3 URLs from go template #1389, Update s3UrlTemplate to be grouped with other s3 configs values #1734)

💣 Breaking Changes

You can find detailed upgrade notes on these braking changes in the upgrading documentation: Upgrading from 3.x - 4.x

Note some breaking changes are missing here and are only referenced in the linked upgrading notes.

• AutoDiscovery takes a list of scans in config file, allowing it to start more than one scan for a identified resource @the-simmon (Allow multiple scantypes to be used in the service and container autodiscovery (closes #1384) #1447)
• Container AutoDiscovery enabled by default and more consistent behavior compared to Service AutoDiscovery @the-simmon (Autodiscovery consistent behavior #1112)
• SSH-Scan (Mozilla ssh_scan) is now considered deprecated as the tool is no longer maintained by mozilla. As a replacement we've added integration for ssh-audit as a replacement. The ssh-scan integration is still in this release but will be removed in a upcoming release. @Reet00 & @sofi0071 (Added new ssh-audit scanner to replace deprecated ssh-scan scanner #1713)
• Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output @J12934 (Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output #1679)
• Findings Format: inconsistent ip address fields removed, replaced with standardized ip_addresses @J12934 (Fix hostOrIP helper in CascadingScans #1701, Use empty array for findings where no ips were identified #1748)
• Allow multiple scanTypes to be used in the Service and Container AutoDiscovery @Ilyesbdlala (Allow multiple scantypes to be used in the service and container autodiscovery (closes #1384) #1447)
• Added optional mitigation attribute to findings @Ilyesbdlala (Added optional mitigation attribute to findings #1639)
• Remove AngularCSTI Integration @J12934 (Remove AngularCSTI Integration #1649)
• Renamed Amass attributes.name to attributes.hostname @Ilyesbdlala (maintenance: renamed Amass attributes.name to attributes.hostname #1605)

🚓 Security Scanner

• Added new DNS Scanner: Doggo @rseedorff (Added new DNS Scanner: Doggo #1446)
• Added new SSH Scanner: ssh-audit @Reet00 & @sofi0071 (Added new ssh-audit scanner to replace deprecated ssh-scan scanner #1713)
• Remove AngularCSTI Scanner Integration @J12934 (Remove AngularCSTI Integration #1649)
• Added optional identified at parameter to findings @Ilyesbdlala (Added optional identified at parameter to findings #1434)
• Added zap-advanced configuration option to change reportType @rseedorff (Added zap-advancedconfiguration option to change reportType #1632)
• Upgraded amass from v3.21.2 to v3.23.2 @secureCodeBoxBot ([SCB-Bot] Upgraded amass from v3.21.2 to v3.22.0 #1634, [SCB-Bot] Upgraded amass from v3.22.0 to v3.22.1 #1641, [SCB-Bot] Upgraded amass from v3.22.1 to v3.22.2 #1652, [SCB-Bot] Upgraded amass from v3.23.1 to v3.23.2 #1719)
• Upgraded ffuf from v1.5.0 to v2.0.0 @secureCodeBoxBot ([SCB-Bot] Upgraded ffuf from v1.5.0 to v2.0.0 #1579)
• Upgraded gitleaks from v8.15.2 to v8.16.3 @secureCodeBoxBot ([SCB-Bot] Upgraded gitleaks from v8.15.2 to v8.15.3 #1559, [SCB-Bot] Upgraded gitleaks from v8.15.3 to v8.15.4 #1614, [SCB-Bot] Upgraded gitleaks from v8.15.4 to v8.16.0 #1615, [SCB-Bot] Upgraded gitleaks from v8.16.0 to v8.16.1 #1643, [SCB-Bot] Upgraded gitleaks from v8.16.1 to v8.16.2 #1665, [SCB-Bot] Upgraded gitleaks from v8.16.2 to v8.16.3 #1697)
• Upgraded kubeaudit from 0.21.0 to 0.22.0 @secureCodeBoxBot ([SCB-Bot] Upgraded kubeaudit from 0.21.0 to 0.22.0 #1654)
• Upgraded nuclei from v2.8.3 to v2.9.6 @secureCodeBoxBot ([SCB-Bot] Upgraded nuclei from v2.8.3 to v2.8.5 #1527, [SCB-Bot] Upgraded nuclei from v2.8.5 to v2.8.6 #1544, [SCB-Bot] Upgraded nuclei from v2.8.6 to v2.8.8 #1561, [SCB-Bot] Upgraded nuclei from v2.8.8 to v2.8.9 #1590, [SCB-Bot] Upgraded nuclei from v2.8.9 to v2.9.0 #1648, [SCB-Bot] Upgraded nuclei from v2.9.0 to v2.9.1 #1671, [SCB-Bot] Upgraded nuclei from v2.9.1 to v2.9.2 #1698, [SCB-Bot] Upgraded nuclei from v2.9.2 to v2.9.3 #1712, [SCB-Bot] Upgraded nuclei from v2.9.3 to v2.9.4 #1721, [SCB-Bot] Upgraded nuclei from v2.9.4 to v2.9.5 #1735, [SCB-Bot] Upgraded nuclei from v2.9.5 to v2.9.6 #1743)
• Upgraded semgrep from 1.1.0 to 1.24.1 @secureCodeBoxBot ([SCB-Bot] Upgraded semgrep from 1.1.0 to 1.2.0 #1517, [SCB-Bot] Upgraded semgrep from 1.2.0 to 1.2.1 #1518, [SCB-Bot] Upgraded semgrep from 1.2.1 to 1.3.0 #1545, [SCB-Bot] Upgraded semgrep from 1.3.0 to 1.5.1 #1558, [SCB-Bot] Upgraded semgrep from 1.5.1 to 1.6.0 #1565, [SCB-Bot] Upgraded semgrep from 1.6.0 to 1.8.0 #1569, [SCB-Bot] Upgraded semgrep from 1.8.0 to 1.9.0 #1578, [SCB-Bot] Upgraded semgrep from 1.9.0 to 1.10.0 #1583, [SCB-Bot] Upgraded semgrep from 1.10.0 to 1.11.0 #1591, [SCB-Bot] Upgraded semgrep from 1.11.0 to 1.12.0 #1596, [SCB-Bot] Upgraded semgrep from 1.12.0 to 1.12.1 #1602, [SCB-Bot] Upgraded semgrep from 1.12.1 to 1.13.0 #1612, [SCB-Bot] Upgraded semgrep from 1.13.0 to 1.14.0 #1616, [SCB-Bot] Upgraded semgrep from 1.14.0 to 1.15.0 #1646, [SCB-Bot] Upgraded semgrep from 1.15.0 to 1.16.0 #1667, [SCB-Bot] Upgraded semgrep from 1.16.0 to 1.17.0 #1675, [SCB-Bot] Upgraded semgrep from 1.17.0 to 1.17.1 #1677, [SCB-Bot] Upgraded semgrep from 1.18.0 to 1.19.0 #1702, [SCB-Bot] Upgraded semgrep from 1.19.0 to 1.20.0 #1709, [SCB-Bot] Upgraded semgrep from 1.20.0 to 1.21.0 #1714, [SCB-Bot] Upgraded semgrep from 1.21.0 to 1.22.0 #1725, [SCB-Bot] Upgraded semgrep from 1.22.0 to 1.23.0 #1733, [SCB-Bot] Upgraded semgrep from 1.23.0 to 1.24.1 #1744)
• Upgraded sslyze from 5.0.6 to 5.1.3 @secureCodeBoxBot ([SCB-Bot] Upgraded sslyze from 5.0.6 to 5.1.1 #1555, [SCB-Bot] Upgraded sslyze from 5.1.1 to 5.1.2 #1637, [SCB-Bot] Upgraded sslyze from 5.1.2 to 5.1.3 #1670)
• Upgraded trivy from 0.35.0 to 0.42.0 @secureCodeBoxBot ([SCB-Bot] Upgraded trivy from 0.35.0 to 0.36.1 #1546, [SCB-Bot] Upgraded trivy from 0.36.1 to 0.37.1 #1572, [SCB-Bot] Upgraded trivy from 0.37.1 to 0.37.2 #1587, [SCB-Bot] Upgraded trivy from 0.37.2 to 0.37.3 #1599, [SCB-Bot] Upgraded trivy from 0.37.3 to 0.38.0 #1617, [SCB-Bot] Upgraded trivy from 0.38.0 to 0.38.1 #1622, [SCB-Bot] Upgraded trivy from 0.38.1 to 0.38.2 #1636, [SCB-Bot] Upgraded trivy from 0.38.2 to 0.38.3 #1644, [SCB-Bot] Upgraded trivy from 0.38.3 to 0.39.0 #1668, [SCB-Bot] Upgraded trivy from 0.39.0 to 0.39.1 #1681, [SCB-Bot] Upgraded trivy from 0.39.1 to 0.40.0 #1695, [SCB-Bot] Upgraded trivy from 0.40.0 to 0.41.0 #1706, [SCB-Bot] Upgraded trivy from 0.41.0 to 0.42.0 #1745)
• Upgraded typo3scan from v1.1.1 to v1.1.2 @secureCodeBoxBot ([SCB-Bot] Upgraded typo3scan from v1.1.1 to v1.1.2 #1653)

⚓️ Hooks

• Add Apikey in generic webhook @srburton (Add Apikey in generic webhook #1526)
• Make userid optional for defectdojo @the-simmon (Make userid optional for defectdojo #1412)

🐛 Bug Fixes

• Renames the hook.image.repository of update-field hook @Ilyesbdlala (Renames the hook.image.repository of update-field hook #1685)
• Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output @J12934 (Improve Nmap Parser to handle multiple / ipv6 addresses and verbose output #1679)
• Fixed Generic WebHook API Key not working correctly @Ilyesbdlala (Fixed Generic WebHook API Key not working correctly #1673)
• Updated snapshot of typo3scan after upgrade @Ilyesbdlala (Updated snapshot of typo3scan after upgrade #1655)
• Added a check for empty Trivy .Results @Ilyesbdlala (Added a check for empty Trivy .Results #1640)
• Fix the link in ADR-0017 in order to fix the Netlify build @Ilyesbdlala (Fix the link in ADR-0017 in order to fix the Netlify build #1631)
• Includes minio authentication in operator makefile @Ilyesbdlala (fix(minio): includes minio authentication in operator makefile #1577)
• Adds error handling to remote version fetching for the scb-bot @Ilyesbdlala (fix(scb-bot): Adds error handling to remote version fetching #1509)

📚 Documentation

• Add Upgrading Notes for Nuclei Findings @J12934 (Add Upgrading Notes for Nuclei Findings #1502)
• Added/fixed missing scantypes @rseedorff (Maintenance - added/fixed missing scantypes #1628)
• Change ADR-0007 State to DRAFT @Weltraumschaf (#1460 Change ADR-0007 State to DRAFT #1548)
• Enforced the use of the node version in .nvmrc @Ilyesbdlala (Enforced the use of the node version in .nvmrc #1645)
• Fix that ADR 17 Breaks Documentation @Weltraumschaf (Fix that ADR 17 Breaks Documentation #1580)
• One failing matrix job no longer stops other version compare jobs @Ilyesbdlala (maitenance(scb-bot): One failing matrix job no longer stops other version compare jobs #1570)
• Remove codeclimate from contributing docs @Weltraumschaf (Remove codeclimate from contributing docs #1464)
• Removed unnecessary dependencies @Ilyesbdlala (Removed unnecessary dependencies #1690)
• Removed unnecessary intializing of scannerVersions in scanner Dockerfiles @Ilyesbdlala (Removed unnecessary intializing of scannerVersions in scanner Dockerfiles #1625)
• The DRAFT status does not have a link, only the SUPERSEDES does @Weltraumschaf (The DRAFT status does not have a link, only the SUPERSEDES does #1638)
• Multiple minor fixes @rseedorff (Maintenance - multiple minor fixes #1627)

• Add missing supported platforms (CPU Architectures, e.g. amd64 or arm64) for Scanners to their helm charts and their documentation pages. @snoopy-cat(Add missing supported platforms for Scanners to Charts #1739)

📌 Dependencies

• Bump cacheable-request and @kubernetes/client-node in /hooks/cascading-scans/hook @dependabot (build(deps): bump cacheable-request and @kubernetes/client-node in /hooks/cascading-scans/hook #1593, build(deps): bump cacheable-request and @kubernetes/client-node in /hooks/notification/hook #1594, build(deps): bump cacheable-request and @kubernetes/client-node in /scanners #1595, build(deps): bump cacheable-request and @kubernetes/client-node in /tests/integration #1592)
• Bump github.com/emicklei/go-restful to 2.16.0+incompatible @dependabot (build(deps): bump github.com/emicklei/go-restful from 2.15.0+incompatible to 2.16.0+incompatible in /operator #1584, build(deps): bump github.com/emicklei/go-restful from 2.9.5+incompatible to 2.16.0+incompatible in /auto-discovery/kubernetes #1585, build(deps): bump github.com/emicklei/go-restful from 2.9.5+incompatible to 2.16.0+incompatible in /lurker #1586)
• Bump golang.org/x/crypto to 0.1.0 @dependabot (build(deps): bump golang.org/x/crypto from 0.0.0-20220214200702-86341886e292 to 0.1.0 in /auto-discovery/kubernetes #1620)
• Bump golang.org/x/net 0.7.0 @dependabot (build(deps): bump golang.org/x/net from 0.0.0-20220127200216-cd36cc0744dd to 0.7.0 in /lurker #1618, build(deps): bump golang.org/x/net from 0.0.0-20220412020605-290c469a71a5 to 0.7.0 in /auto-discovery/kubernetes #1621, build(deps): bump golang.org/x/net from 0.0.0-20220516133312-45b265872317 to 0.7.0 in /operator #1619)
• Bump golang.org/x/text 0.3.8 @dependabot (build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /auto-discovery/kubernetes #1609, build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /lurker #1608, build(deps): bump golang.org/x/text from 0.3.7 to 0.3.8 in /operator #1611)
• Bump http-cache-semantics from 4.1.0 to 4.1.1 @dependabot (Bump http-cache-semantics from 4.1.0 to 4.1.1 in /hooks/cascading-scans/hook #1575, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /hooks/notification/hook #1576, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /scanners #1573, Bump http-cache-semantics from 4.1.0 to 4.1.1 in /tests/integration #1574)
• Bump json5 to 2.2.3 @dependabot (Bump json5 from 2.2.0 to 2.2.3 #1531, Bump json5 from 2.2.0 to 2.2.3 in /hooks/finding-post-processing/hook #1533, Bump json5 from 2.2.0 to 2.2.3 in /hooks/generic-webhook/hook #1535, Bump json5 from 2.2.0 to 2.2.3 in /hooks/notification/hook #1534, Bump json5 from 2.2.0 to 2.2.3 in /hooks/persistence-azure-monitor/hook #1536, Bump json5 from 2.2.0 to 2.2.3 in /hooks/persistence-elastic/hook #1537, Bump json5 from 2.2.0 to 2.2.3 in /hooks/update-field-hook/hook #1538, Bump json5 from 2.2.0 to 2.2.3 in /scanners #1532, Bump json5 from 2.2.0 to 2.2.3 in /tests/integration #1530, Bump json5 from 2.2.1 to 2.2.3 in /hooks #1539, Bump json5 from 2.2.1 to 2.2.3 in /hooks/cascading-scans/hook #1540, Bump json5 from 2.2.1 to 2.2.3 in /scanners/ffuf/parser #1543)
• Bump luxon from 2.0.2 to 2.5.2 in /hooks/persistence-elastic/hook @dependabot (Bump luxon from 2.0.2 to 2.5.2 in /hooks/persistence-elastic/hook #1542, Bump xml2js from 0.4.23 to 0.5.0 in /scanners/nmap/parser #1688, Bump xml2js from 0.4.23 to 0.5.0 in /scanners/zap/parser #1686, [Snyk] Security upgrade xml2js from 0.4.23 to 0.5.0 #1682)
• Upgrade @kubernetes/client-node from 0.17.1 to 0.18.1 @snyk-bot ([Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1550, [Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1529, [Snyk] Upgrade @kubernetes/client-node from 0.17.1 to 0.18.0 #1547, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1597, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1589, [Snyk] Upgrade @kubernetes/client-node from 0.18.0 to 0.18.1 #1604)
• Upgrade ajv from 8.11.2 to 8.12.0 @snyk-bot ([Snyk] Upgrade ajv from 8.11.2 to 8.12.0 #1560)
• Upgrade axios to 1.4.0 @snyk-bot ([Snyk] Upgrade axios from 1.1.2 to 1.2.0 #1524)
• Upgrade axios from 1.1.2 to 1.2.0 @snyk-bot ([Snyk] Upgrade axios from 1.1.2 to 1.2.0 #1523, [Snyk] Upgrade axios from 1.1.3 to 1.2.0 #1508, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1556, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1562, [Snyk] Upgrade axios from 1.2.0 to 1.2.2 #1564, [Snyk] Upgrade axios from 1.2.2 to 1.2.3 #1582, [Snyk] Upgrade axios from 1.2.2 to 1.2.3 #1588, [Snyk] Upgrade axios from 1.2.2 to 1.3.0 #1606, [Snyk] Upgrade axios from 1.2.3 to 1.2.5 #1601, [Snyk] Upgrade axios from 1.2.3 to 1.2.5 #1603, [Snyk] Upgrade axios from 1.2.5 to 1.3.1 #1610, [Snyk] Upgrade axios from 1.2.5 to 1.3.3 #1635, [Snyk] Upgrade axios from 1.3.0 to 1.3.2 #1623, [Snyk] Upgrade axios from 1.3.1 to 1.3.2 #1624, [Snyk] Upgrade axios from 1.3.2 to 1.3.3 #1630, [Snyk] Upgrade axios from 1.3.2 to 1.3.3 #1633, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1650, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1647, [Snyk] Upgrade axios from 1.3.3 to 1.3.4 #1651, [Snyk] Upgrade axios from 1.3.4 to 1.3.5 #1711, [Snyk] Upgrade axios from 1.3.4 to 1.3.5 #1705, [Snyk] Upgrade axios from 1.3.4 to 1.3.5 #1707, [Snyk] Upgrade axios from 1.3.5 to 1.3.6 #1720, [Snyk] Upgrade axios from 1.3.5 to 1.3.6 #1723, [Snyk] Upgrade axios from 1.3.5 to 1.3.6 #1724, [Snyk] Upgrade axios from 1.3.6 to 1.4.0 #1732, [Snyk] Upgrade axios from 1.3.6 to 1.4.0 #1727, [Snyk] Upgrade axios from 1.3.6 to 1.4.0 #1736)
• Upgrade ws from 8.11.0 to 8.13.0 @snyk-bot ([Snyk] Upgrade ws from 8.11.0 to 8.12.0 #1566, [Snyk] Upgrade ws from 8.11.0 to 8.12.0 #1568, [Snyk] Upgrade ws from 8.12.0 to 8.13.0 #1669, [Snyk] Upgrade ws from 8.12.0 to 8.13.0 #1672)
• Upgrading jest to 29.3.1 @Ilyesbdlala (maintenance(jest): Upgrading jest to 29.3.1 #1567)

Distribution

Contributors

Thanks to all our contributors supporting this project 🤗
@Ilyesbdlala, @the-simmon, @Reet00, @sofi0071, @ManuelNeuer, @Weltraumschaf, @fphoer, @malexmave, @srburton, @snoopy-cat, @rseedorff and @J12934