PodiumD - Image scanning CVE's

[alextreme]

Thema / Theme

Other

Omschrijving / Description

Taiga Dimpact 245
https://taiga.maykinmedia.nl/project/dimpact-enschede-ssc-ict-1/issue/245

Request is to analyse which images were scanned

Toegevoegde waarde / Added value

No response

Aanvullende opmerkingen / Additional context

No response

[stevenbal]

@alextreme @joeribekker as discussed this could be fixed by just releasing new versions with a new docker build, instead of actually analyzing these vulnerabilities right?

When it comes to supporting versions, I assume we mean supporting the current (new features/bugfixes/security updates) and previous major version (bugfixes/security updates)? Which would mean that we currently should do (at least) patch updates every month for:

Open Zaak: 1.19.0 (latest), not supporting <1.0
Open Notificaties: 1.8.1 (latest), not supporting <1.0
Objects API: 3.0.2 (latest) and 2.5.0
Objecttypes API: 3.0.1 (latest) and 2.3.0
Open Klant: 2.6.1 (latest), not supporting 1.0.0 since it's an outdated data model that was more of a proof of concept from what I understand
Referentielijsten: 0.3.1 (latest)

With the past two release cycles I've only created issues to make new releases based on the latest version. If the release policy I mentioned above is what we want, I'll make sure to create issues to also make patch releases for the previous versions.

[alextreme]

@stevenbal I'd recommend to double-check the 3 Objects API CVE's mentioned which were found in 3.0.0 (which was a lot less than 2.5). If these no longer are applicable in 3.0.2 then it's at least clear that we're tackling them correctly.