Questions tagged [fortify]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
193 views

Best Practice for Suppressing Fortify SCA Findings

So I have been searching for an answer as to how you should treat false positives in Fortify scans. For a long time if something was determined to be a false positive I would document the reasoning ...
1
vote
0answers
18 views

Does application security assessments done using SaaS solutions (WhiteHat Sentinal and Fortify on Demand) count as penetration tests?

SaaS security solutions such as "WhiteHat Sentinal" and "Fortify on Demand" are getting popular now a days. Methodologies of both describe them involving manual verification. Does this qualify the ...
5
votes
3answers
2k views

Safely load a pickle file?

In our Python app, we are using pickle.load to load a file named perceptron.pkl. A HP Fortify static scan raises a high vulnerability, "Dynamic Code Evaluation - Unsafe Pickle Deserialization", at the ...
1
vote
1answer
444 views

Fortify and third-party libraries [closed]

I am trying to understand in the new version of Fortify SCA 17.10, why the scan defaults to excluding third-party libraries? I found this article and it seems any open source library you use, it would ...
3
votes
2answers
2k views

HP Fortify scan automation

I am asked to integrate the code audit tool HP Fortify in our development process, but the main constraint about it is that the whole code should not be scanned every time: only the classes impacted ...