feat(helm): Use Valkey #13408
Merged
feat(helm): Use Valkey #13408
DryRunSecurity / General Security Analyzer
succeeded
Nov 26, 2025 in 2m 6s
DryRun Security
Details
General Security Analyzer Findings: 3 detected
⚠️ Supply Chain Risk from New Dependency helm/defectdojo/Chart.yaml (click for details)
| Type | Supply Chain Risk from New Dependency |
| Description | The Helm chart introduces a new dependency, valkey, from an external OCI registry oci://registry-1.docker.io/cloudpirates. This registry is not officially associated with the Valkey project. Sourcing dependencies from unverified third-party registries introduces a significant supply chain risk, as the integrity and authenticity of the distributed chart cannot be guaranteed. While a SHA256 digest is present in Chart.lock, it only verifies that the downloaded chart matches the one recorded in Chart.lock. It does not protect against a scenario where the cloudpirates repository itself is compromised and distributes a malicious chart with a new, valid digest. |
| Filename | helm/defectdojo/Chart.yaml |
| CodeLink | django-DefectDojo/helm/defectdojo/Chart.yaml Lines 18 to 21 in 1be8710 |
⚠️ Insufficient Entropy in Valkey Password Generation helm/defectdojo/templates/secret-valkey.yaml (click for details)
| Type | Insufficient Entropy in Valkey Password Generation |
| Description | The Helm chart generates a 10-character alphanumeric password for Valkey when no password is explicitly provided. This results in an entropy of approximately 59.54 bits. This level of entropy is significantly lower than modern security recommendations for machine-to-machine secrets (typically 128 bits or more). This makes the generated password vulnerable to brute-force attacks, which could compromise the Valkey instance. |
| Filename | helm/defectdojo/templates/secret-valkey.yaml |
| CodeLink | django-DefectDojo/helm/defectdojo/templates/secret-valkey.yaml Lines 33 to 36 in 1be8710 |
⚠️ Weak TLS Configuration by Default helm/defectdojo/templates/_helpers.tpl (click for details)
| Type | Weak TLS Configuration by Default |
| Description | The Helm chart for DefectDojo sets ssl_cert_reqs=optional as the default for Valkey/Redis connections when TLS (rediss scheme) is enabled. This configuration disables server certificate validation, making the connection vulnerable to Man-in-the-Middle (MitM) attacks. While the valkeyParams or redisParams can override this, the insecure default is applied if not explicitly changed. Best practice dictates ssl_cert_reqs=required for production environments to ensure server authenticity and prevent eavesdropping or tampering. |
| Filename | helm/defectdojo/templates/_helpers.tpl |
| CodeLink | django-DefectDojo/helm/defectdojo/templates/_helpers.tpl Lines 73 to 76 in 1be8710 |
Loading