Comments (2)
First question you should ask yourself is why you're scanning a build tool for its known vulnerable dependencies in a blocking step of a software delivery pipeline.
Looks like you're not scanning the right folders. Scanning the tool would be a good practice for a build tooling vulnerability monitoring pipeline, not for an individual software project I'd say.
So the best way to handle your current blockage is by making sure that you scan only your project and its (runtime) dependencies.
Upgrade of h2 is not foreseen until v 10.x (as the h2 upgrade could/would break builds) - #6132, but the vulnerability reported on it is disputed by the authors and applicable only to running h2 as a local db server with a web console, so not applicable to OWASP DC's usage of it as an embedded database engine.
Logback is referred in #6178 as an update requiring more work. If it's the same CVE that gets flagged then the usage of OWASP DC is not affected by it.
Bouncycastle would need some deeper look, but I'm away from computer until after the weekend.
from dependencycheck.
Thanks for the feedback, I assumed it could be by design.
The config I used is spelling out the paths to scan, but I found the issue based on your feedback. I see that the previous person configured "-s .", causing this behaviour. I removed this and it is no longer reporting on OWASP.
from dependencycheck.
Related Issues (20)
- override central.content.url and analyzer.central.retry.count HOT 5
- Solution to scan the environment.yml python dependencies using OWASP Dep Check in Jenkins pipeline HOT 1
- Wrong CPE for org.evolvis.tartools:background-jobs HOT 2
- [FP]: togglz-mongodb-4.4.0.jar is mixed up with mongodb-4.4.0.jar HOT 14
- [Question] How use NVD Data feed argument HOT 1
- While running dependency in angular project we get [ERROR] java.lang.NullPointerException: null, can that be ignored HOT 1
- Recoverable I/O exception for https://services.nvd.nist.gov/ HOT 5
- Getting started with mysql storage, batch processing is taking forever
- A lot of erors appears using dependency check in gitlab ci HOT 2
- Connection to proxy is not successed
- The maven plugin does not take into account the vendor, hence many false positives HOT 10
- [FP]: CVE-2024-34447 for bcprov-jdk15on-1.60.jar HOT 5
- [FP]: [email protected] HOT 1
- [FP]: pkg:nuget/[email protected] HOT 3
- [FP]: Custom package `openapi-generator-templates` != `openapi_generator` HOT 6
- nuspec parse exception HOT 3
- [FP]: False positive for [email protected] for CVE-2024-29131 and CVE-2024-29133 HOT 8
- [FP]: org.eclipse.jetty.toolchain/[email protected] is misidentified as jetty 4.0.6 component (but is not) (wrong CPE) HOT 4
- Report writing fails due to missing class: StringEscapeUtils HOT 6
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependencycheck.