Skip to content

WebVigil 1.0.2

Choose a tag to compare

View all tags
@ryanvmorais ryanvmorais released this 08 Oct 18:49
· 23 commits to main since this release
v1.0.2
601743c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Patch release with one fix, in the error-page signatures of the information-disclosure check. The CLI, the exit codes, the configuration keys, the check ids and the JSON report do not change.

  • The patterns that recognise Java, Node.js and Python stack traces and the Django and Rails debug pages are bounded, so a page from the scanned site can no longer keep a scan busy for a long time in them. The signatures now read the first 256 KiB of a body: a framework error that appears only past that point is no longer recognised.
  • Upgrade: pipx upgrade webvigil, or docker pull ghcr.io/ryanvmorais/webvigil:1.0.2.

Scan only systems you own or have permission to test. The compatibility promise is in docs/stability.md.

Security advisory: GHSA-wxvq-cw49-p7f6

Full list of what changed in 1.0.2: CHANGELOG

Assets 2
Loading