Update ZAP addons
Problem to solve
ZAP has updated vulnerability definitions. See Releases for information about each release.
The following addons are available for update:
- openapi v16.0.0
- pscanrules v29.0.0
- webdriverlinux v18.0.0
- fuzzdb v7.0.0
- ascanrules v35.0.0
- webdrivermacos v17.0.0
- pscanrulesBeta v22.0.0
- webdriverwindows v18.0.0
- ascanrulesBeta v28.0.0
- commonlib v1.0.0
Intended users
Proposal
-
DAST Dockerfile should be updated to download new vulnerabilities -
Changelog should describe changes -
Tests should be updated -
Update the identify-addon-updates.sh
script to use the GitLab API to create a new issue in DAST.- Add labels
group::dynamic analysis
,backend
,devops::secure
, andfeature
- Add the title
Update ZAP vulnerabilities [DD-MM-YYYY]
.DD-MM-YYYY
should be the date when it was first discovered that new vulnerabilities have been released. - Include in the issue description the vulnerabilities that need updating
- Add labels
-
Before creating the issue, check to see if DAST has an open issue starting with Update ZAP vulnerabilities
. If so, don't create the issue.
Documentation
Availability & Testing
What does success look like, and how can we measure that?
What is the type of buyer?
Edited by Cameron Swords