DependencyCheck
DependencyCheck is a software component analysis tool that detects public vulnerabilities in the dependencies of projects. The tool establishes Common Platform Numbering identifiers for dependencies, creating reports that link to relevant vulnerability records. At least version Java 11 is required to run, and authentication is recommended for Sonatype Guide integrations with NVD API.
dependency-check · Build Systems & Monorepos
- You identify public vulnerabilities involved in the dependencies of projects.
- You create reports linking to relevant CVE records by finding CPE identifiers for dependencies.
- You can configure analysis settings via CLI, Maven, Gradle or Ant integrations.
- ↓ NegativeGitHub Issue
Cannot complete initial NVD download - 503 status
“**Describe the bug** The default configuration, with an API key, is either making requests too quickly, or not retrying enough, or both. It always eventually fails with a 503 error from NVD. **Version of dependency-check used** Maven plugin 9.0.0 **Log file** ``` [INFO] ---…”
- ↓ NegativeGitHub Issue
DatabaseException: Error updating 'CVE-2020-36569'
“**Describe the bug** classpath 'com.android.tools.build:gradle:4.1.1' gradle version is: 7.0.2 after run ./gradlew dependencyCheckAnalyze in logs falls down, this error: ```> Task :dependencyCheckUpdate org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating…”