This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
OWASP Dependency Track Project
OWASP Dependency-TrackOWASP Dependency-Track is an intelligent Software Composition Analysis (SCA) application that allows organizations to automatically ingest and identify vulnerable third-party components. IntroductionOver the last several years, organizations have faced a growing trend on the number of vulnerabilities reported due to the use of vulnerable third-party components. The risk involved in using third-party components is described in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "The Unfortunate Reality of Insecure Libraries". This upward trend propelled the use of third-party components into a new category in the OWASP Top Ten, specifically, A9: Using Components with Known Vulnerabilities. OWASP Dependency-Track is designed to enable organizations to easily identify use of vulnerable components across an entire portfolio of applications. OWASP Dependency-Track can monitor vulnerable component usage for applications that are in production (via static components), and can be leveraged in continuous security environments to enable real-time feedback and increased visibility to DevOps teams. DescriptionDependency-Track has two main goals:
Dependency-Track incorporates a web-based asset management system specifically designed to track applications and the components that each application relies on. Many organizations have legal or new product introduction requirements that require software engineering teams to provide documentation on the use of third-party components. Dependency-Track fulfills this requirement. Using the Dependency-Track database as the sole source of evidence, the system will check the National Vulnerability Database (NVD) to determine if the components contain known vulnerabilities. Dependency-Track embeds OWASP Dependency-Check, a tool used to automatically identify components and determine if they contain known vulnerabilities. Dependency-Track varies from Dependency-Check in how evidence is obtained. While Dependency-Check relies on files on a filesystem or build environment to scan, Dependency-Track relies on user supplied metadata about each component. These two techniques are complimentary and fulfill different requirements. Often times, an organization may rely upon both systems for a comprehensive solution. LicensingOWASP Dependency-Track is licensed under the Apache 2.0 license.
|
Quick DownloadDependency-Track is available as a Docker container and a deployable WAR. News and Events
Features
PresentationIntroducing OWASP Dependency-Track (on SlideShare) OWASP Dependency-Track (on YouTube) DocumentationDependency-Track Project Wiki on GitHub Project LeaderRelated ProjectsClassifications
|
- What are the system requirements?
- Dependency-Track requires Java 8 or higher and can run on any Servlet 3.1 container such as Tomcat 8.5 and higher. Dependency-Track may also be used with Docker.
- What type of database is used?
- Dependency-Track embeds the H2 database engine. A standalone database server may optionally be used.
- What vulnerability datasources are supported
- National Vulnerability Database (NVD), Node Security Platform (NSP), and VulnDB (from Risk Based Security). Private vulnerabilities can also be added manually or via the REST API.
- How often are the datasources refreshed?
- The NVD and NSP sources are updated every 24 hours. VulnDB is also refreshed every 24 hours, but requires the use of VulnDB Data Mirror.
- What is the NVD mirror feature?
- For organizations that run Dependency-Check, it is possible to specify an alternate URL for the NIST/NVD data. This allows organizations with many Dependency-Check instances to take advantage of an internal mirror for faster access. The NIST/NVD data feed can be used by specifying http://HOSTNAME/CONTEXT/nist/FILENAME. For example: http://localhost:8080/dtrack/nist/nvdcve-2.0-2002.xml.gz. The NVD mirror is automatically updated every 24 hours.
Login screen
Dashboard
List of applications
Expanded list of applications
Components used in an application
List of all components
Vulnerabilities in third-party components
Creating a new component
Search for component usage across all applications
User management
This project would not be possible without the existence of the OWASP_Dependency_Check project. Special thanks to Jeremy Long and the Dependency-Check core team for their hard work.
Dependency-Track Core Team
- Steve Springett
Past Contributors
- Nikhil Chitlur Navakiran (initial 1.0.0 release)
Sponsors
OWASP Dependency-Track is an open source project, created by people who believe that the knowledge of using vulnerable components should be accessible to anyone with a desire to know. By supporting this project, you'll allow the team to outsource testing, infrastructure, further research and development efforts, and engage in outreach to various communities that would benefit from this technology.
As of November 2017, the priorities are:
- Complete VulnDB mirroring
- Create dashboard
- Complete widgets by incorporating metrics
- Complete CycloneDX and SPDX import support
- Release v3.0.0 in Q1 2018
Feedback
Please use the Dependency-Track mailing list for feedback:
- What you like?
- What you don't like?
- What could be improved?
- v1.0.0 (19 Feb 2015)
- Initial general availability release.
| PROJECT INFO What does this OWASP project offer you? |
RELEASE(S) INFO What releases are available for this project? | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| |||||||||||||||||||||||||||||||||||||||
