Unable to detect known vulnerability in gradle plugin

[dependency-check]

Unable to detect known vulnerability in gradle plugin

[jeremylong]

Can you share your configuration? What version are you using? I just tested this with the current snapshot (1.4.3-SNAPSHOT) and it detected the vulnerability. See attached:
gradel-test.zip

[ajaytestacc]

Version: 1.4.2
apply plugin: "org.owasp.dependencycheck" buildscript { repositories { maven { url "https://plugins.gradle.org/m2/" } } dependencies { classpath "gradle.plugin.org.owasp:dependency-check-gradle:1.4.2" } }

[ajaytestacc]

Thanks @jeremylong
Updated current version org.owasp:dependency-check-gradle:1.4.3 and it's working now

[stefanneuhaus]

Observations:

I observed a very similar issue with 1.4.2:

• Locally dependencyCheckUpdate failed reproducibly saying Unable to connect to the dependency-check database. Though the fetched database had a reasonable size of ~265 MB. dependencyCheck successfully detected a bunch of vulnerabilities, but it did not detect CVE-2016-3720.
• On the CI server CVE-2016-3720 was detected.

After upgrade to 1.4.3:

• Locally dependencyCheck still did not detect CVE-2016-3720 (with the presumably corrupted DB). But now it detected CVE-2015-6420 for the first time.
• After clearing the DB, dependencyCheckUpdate successfully fetched the DB and dependencyCheck detected CVE-2016-3720. It also detected CVE-2016-3092 for the first time. I could verify this behavior twice in a row.

Conclusion:

Regarding this "Unable to detect known vulnerability in gradle plugin" issue, to me it seems like 1.4.3 fixed some issue with fetching the database, which was the actual root cause.

[jeremylong]

Your conclusion is correct. I will be posting information about this on the mailing list and twitter shortly. I am just waiting for the updated Jenkins plugin to be updated.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.