Skip to content

Home

Jump to bottom
Jeremy Long edited this page Jun 19, 2013 · 14 revisions

The purpose of dependency-check is to help notify developers and security professionals of the problem discussed by Jeff Williams and Arshan Dabirsiaghi in their talk at AppSec DC 2012 titled "The Unfortunate Reality of Insecure Libraries". The gist of the presentation is that we as a development community include third party libraries in our applications that contain well known published vulnerabilities (such as those at the National Vulnerability Database).

Currently, dependency-check is a (java) command line tool that scans directories and files. If it contains an Analyzer that can scan a particular file type then information about the file is collected. This information is then used to identify the Common Platform Enumeration (CPE). If a CPE is identified a listing of associated Common Vulnerability and Exposure (CVE) entries are listed in a report.

Dependency-check automatically updates itself using the NVD Data Feeds hosted by NIST. NOTE: the initial download of data may take five minutes or more. If the tool is run at least once every 7 days then only a small XML file needs to be downloaded to keep the data current.

More information about dependency-check can be found here:

To use dependency-check you need to download the project from github and compile the project using Maven. Once compiled it can be run using the following commands (replacing [version] with the current version):

Display Help:

java -jar dependency-check-[version].jar -h

Scan a directory called 'lib' in an application called 'Sample' and writes the report in the current working directory:

java -jar dependency-check-[version].jar --scan "/path/to/lib" --app Sample --out .

The above command will produce a file in the current working directory called DependencyCheck-Report.html.

If you have any questions or comments please contact me on the dependency-check mailing list:

Clone this wiki locally