Comments (6)
Can you share your configuration? What version are you using? I just tested this with the current snapshot (1.4.3-SNAPSHOT) and it detected the vulnerability. See attached:
gradel-test.zip
from dependency-check-gradle.
Version: 1.4.2
apply plugin: "org.owasp.dependencycheck" buildscript { repositories { maven { url "https://plugins.gradle.org/m2/" } } dependencies { classpath "gradle.plugin.org.owasp:dependency-check-gradle:1.4.2" } }
from dependency-check-gradle.
Thanks @jeremylong
Updated current version org.owasp:dependency-check-gradle:1.4.3
and it's working now
from dependency-check-gradle.
Observations:
I observed a very similar issue with 1.4.2:
- Locally
dependencyCheckUpdate
failed reproducibly sayingUnable to connect to the dependency-check database
. Though the fetched database had a reasonable size of ~265 MB.dependencyCheck
successfully detected a bunch of vulnerabilities, but it did not detect CVE-2016-3720. - On the CI server CVE-2016-3720 was detected.
After upgrade to 1.4.3:
- Locally
dependencyCheck
still did not detect CVE-2016-3720 (with the presumably corrupted DB). But now it detected CVE-2015-6420 for the first time. - After clearing the DB,
dependencyCheckUpdate
successfully fetched the DB anddependencyCheck
detected CVE-2016-3720. It also detected CVE-2016-3092 for the first time. I could verify this behavior twice in a row.
Conclusion:
Regarding this "Unable to detect known vulnerability in gradle plugin" issue, to me it seems like 1.4.3 fixed some issue with fetching the database, which was the actual root cause.
from dependency-check-gradle.
Your conclusion is correct. I will be posting information about this on the mailing list and twitter shortly. I am just waiting for the updated Jenkins plugin to be updated.
from dependency-check-gradle.
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
from dependency-check-gradle.
Related Issues (20)
- Force use of vulnerable dependency to check if project works HOT 6
- java.util.concurrent.ExecutionException: org.gradle.api.GradleException: Failed to create Jar file /home/gradle/.gradle/caches/jars-9/b434e5cc9816519e3d9b77bd3c65f31a/jackson-core-2.16.0.jar. when try to upgrade the Owasp latest 9.0.0 version in Gitlab Pipeline HOT 1
- Dependency report configuration (size) HOT 2
- Default scanset omits pnpm-lock.yaml
- Support for vulnerability analysis of gradle version catalog HOT 1
- default data directory in v9
- Database Compability Issue when using Spring Boot 3.2.0
- Sources link on GPP doesn't point to a URL HOT 2
- How to configure the NVD API key? HOT 1
- Redacting the HTML Report HOT 1
- Can props from build.gradle.kts be overwritten with -D or -P parameter? HOT 3
- Lots of NVD API request failures HOT 1
- Error when trying to build image with jib. HOT 3
- java.lang.ClassNotFoundException: org.apache.commons.codec.Charsets with 9.0.10 HOT 6
- Build never finishes with AGP 8.3 HOT 1
- Possibly conflicting information regarding gradle subprojects HOT 6
- Gradle Version Used in 9.1.0 HOT 6
- Please check contains "test" for `skipTestGroups`, not starts with HOT 5
- Plugin make project build fail HOT 5
- Add NVD API key as a parameter HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependency-check-gradle.