Dependency-Check is an open source utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. The purpose of Dependency-Check is to help notify developers and security professionals of the problem discussed by Jeff Williams and Arshan Dabirsiaghi in their talk at AppSec DC 2012 titled “The Unfortunate Reality of Insecure Libraries“.
Dependency-Check is able to identify Java and Python components along with .NET assemblies. Once identified, Dependency-Check will automatically determine if those component have known, publicly disclosed, vulnerabilities.
The Dependency-Check Jenkins Plugin features the ability to perform a dependency analysis build and later view results post build. The plugin is built using analysis-core and features many of the same features that Jenkins static analysis plugins offer, including thresholds, charts and the ability to view vulnerability information should a dependency have one identified.
Dependency-Check is the core engine that includes the evidence-based identification, analysis, and reporting of library information and associated vulnerabilities. Dependency-Check includes a command line interface (CLI), an Ant task, and Maven plugin. All three generate the same HTML and XML reports. The Dependency-Check Jenkins Plugin relies on the XML report generated from the CLI, Ant task or Maven plugin. It's recommended to include a Dependency-Check scan as part of a build process, similar to how a Findbugs or PMD analysis is typically performed.
The Dependency-Check Jenkins Plugin also includes everything necessary to execute an analysis outside of a build script by incorporating the Dependency-Check core engine and associated Jenkins build-step.
Dependency-Check builds can be run in a continuous integration or nightly basis to determine if there are new vulnerabilities discovered based on the addition of a new dependency, or the discovery of a new vulnerability in an existing dependency. This is highly desirable information for projects in active development and for those being sustained.
Dependency-Check builds in Jenkins can be used outside of a software engineering context by automatically scanning and analyzing third-party applications where source code is not available. In this scenario, Jenkins behaves like a glorified cron job with built-in reporting capabilities. An enterprise for example, could scan and analyze all third-party applications (commercial or otherwise) for libraries containing publicly known vulnerabilities and proactively address issues when they arise.
Development of OWASP Dependency-Check Jenkins Plugin is sponsored in part by Axway.
Skip to end of metadata Go to start of metadata