This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Dependency Check"
Jeremy.long (talk | contribs) (→Quick Download) |
(→Quick Download: Updated version numbers to 2.0.0) (Tag: Visual edit) |
||
| Line 2: | Line 2: | ||
<div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div> | <div style="width:100%;height:90px;border:0,margin:0;overflow: hidden;">[[File: flagship_big.jpg|link=]]</div> | ||
{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- | {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |- | ||
| − | | valign="top" | + | | valign="top" style="border-right: 1px dotted gray;padding-right:25px;" | |
==OWASP Dependency-Check== | ==OWASP Dependency-Check== | ||
| Line 17: | Line 17: | ||
Dependency-check automatically updates itself using the [http://nvd.nist.gov/download.cfm NVD Data Feeds] hosted by NIST. '''IMPORTANT NOTE:''' The initial download of the data may take ten minutes or more, if you run the tool at least once every seven days only a small XML file needs to be downloaded to keep the local copy of the data current. | Dependency-check automatically updates itself using the [http://nvd.nist.gov/download.cfm NVD Data Feeds] hosted by NIST. '''IMPORTANT NOTE:''' The initial download of the data may take ten minutes or more, if you run the tool at least once every seven days only a small XML file needs to be downloaded to keep the local copy of the data current. | ||
| − | | valign="top" | + | | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" | |
== Quick Download == | == Quick Download == | ||
| − | Version | + | Version 2.0.0 |
| − | * [http://dl.bintray.com/jeremy-long/owasp/dependency-check- | + | * [http://dl.bintray.com/jeremy-long/owasp/dependency-check-2.0.0-release.zip Command Line] |
| − | * [http://dl.bintray.com/jeremy-long/owasp/dependency-check-ant- | + | * [http://dl.bintray.com/jeremy-long/owasp/dependency-check-ant-2.0.0-release.zip Ant Task] |
| − | * [http://search.maven.org/#artifactdetails%7Corg.owasp%7Cdependency-check-maven% | + | * [http://search.maven.org/#artifactdetails%7Corg.owasp%7Cdependency-check-maven%7C2.0.0%7Cmaven-plugin Maven Plugin] |
| − | * [http://search.maven.org/#artifactdetails%7Corg.owasp%7Cdependency-check-gradle% | + | * [http://search.maven.org/#artifactdetails%7Corg.owasp%7Cdependency-check-gradle%7C2.0.0%7Cgradle-plugin Gradle Plugin] |
* [https://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin Jenkins Plugin] | * [https://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin Jenkins Plugin] | ||
* [http://brew.sh/ Mac Homebrew]:<br><code>brew update && brew install dependency-check</code> | * [http://brew.sh/ Mac Homebrew]:<br><code>brew update && brew install dependency-check</code> | ||
| Line 63: | Line 63: | ||
{| width="200" cellpadding="2" | {| width="200" cellpadding="2" | ||
|- | |- | ||
| − | | align="center" valign="top" width="50% | + | | rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-flagship-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Flagship_Projects]] |
| − | | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]] | + | | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=]] |
|- | |- | ||
| − | | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]] | + | | align="center" valign="top" width="50%" | [[File:Owasp-defenders-small.png|link=]] |
|- | |- | ||
| − | | colspan="2" align="center" | + | | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]] |
|- | |- | ||
| − | | colspan="2" align="center" | + | | colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]] |
|} | |} | ||
| Line 95: | Line 95: | ||
| − | __NOTOC__ <headertabs /> | + | __NOTOC__ <headertabs></headertabs> |
| − | [[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]] | + | [[Category:OWASP Project]] |
| + | [[Category:OWASP_Builders]] | ||
| + | [[Category:OWASP_Defenders]] | ||
| + | [[Category:OWASP_Document]] | ||
Revision as of 12:24, 3 July 2017
OWASP Dependency-CheckDependency-Check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. Currently Java and .NET are supported; additional experimental support has been added for Ruby, Node.js, Python, and limited support for C/C++ build systems (autoconf and cmake). The tool can be part of a solution to the OWASP Top 10 2013 A9 - Using Components with Known Vulnerabilities. IntroductionThe OWASP Top 10 2013 contains a new entry: A9 - Using Components with Known Vulnerabilities. Dependency-check can currently be used to scan applications (and their dependent libraries) to identify any known vulnerable components. The problem with using known vulnerable components was described very well in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "The Unfortunate Reality of Insecure Libraries" (registration required). The gist of the paper is that we as a development community include third party libraries in our applications that contain well known published vulnerabilities (such as those at the National Vulnerability Database). Dependency-check has a command line interface, a Maven plugin, an Ant task, and a Jenkins plugin. The core engine contains a series of analyzers that inspect the project dependencies, collect pieces of information about the dependencies (referred to as evidence within the tool). The evidence is then used to identify the Common Platform Enumeration (CPE) for the given dependency. If a CPE is identified, a listing of associated Common Vulnerability and Exposure (CVE) entries are listed in a report. Dependency-check automatically updates itself using the NVD Data Feeds hosted by NIST. IMPORTANT NOTE: The initial download of the data may take ten minutes or more, if you run the tool at least once every seven days only a small XML file needs to be downloaded to keep the local copy of the data current. |
Quick DownloadVersion 2.0.0
Other Plugins IntegrationsLinksDocumentationMailing ListPresentationClassifications
| |||||||
