diff --git a/SampleReport.html b/SampleReport.html index 069b363c0..a4748fdfc 100644 --- a/SampleReport.html +++ b/SampleReport.html @@ -65,13 +65,14 @@ $('#modal-text').focus(); $('#modal-text').select(); } - function toggleDisplay(el, clzName) { + function toggleDisplay(el, clzName, all, some) { $(clzName).toggle(); - if (el.innerHTML == 'show all') { - el.innerHTML = 'less'; + if (el.innerHTML == all) { + el.innerHTML = some; } else { - el.innerHTML = 'show all'; + el.innerHTML = all; } + return false; } + + + + + + + + + + + Fork me on GitHub + + + + + +
+ + + + + +
+
+ +
+ + +
+ +

How does dependency-check work?

+

Dependency-check works by collecting information about the files it scans (using Analyzers). The information collected is called Evidence; there are three types of evidence collected: vendor, product, and version. For instance, the JarAnalyzer will collect information from the Manifest, pom.xml, and the package names within the JAR files scanned and it has heuristics to place the information from the various sources into one or more buckets of evidence.

+

Within the NVD CVE Data (schema can be found here) each CVE Entry has a list of vulnerable software:

+ +
+
  <entry id="CVE-2012-5055">
+  ...
+    <vuln:vulnerable-software-list>
+      <vuln:product>cpe:/a:vmware:springsource_spring_security:3.1.2</vuln:product>
+      <vuln:product>cpe:/a:vmware:springsource_spring_security:2.0.4</vuln:product>
+      <vuln:product>cpe:/a:vmware:springsource_spring_security:3.0.1</vuln:product>
+
+

These CPE entries are read “cpe:/[Entry Type]:[Vendor]:[Product]:[Version]:[Revision]:…”. The CPE data is collected and stored in a Lucene Index. Dependency-check then use the Evidence collected and attempt to match an entry from the Lucene CPE Index. If found, the CPEAnalyzer will add an Identifier to the Dependency and subsequently to the report. Once a CPE has been identified the associated CVE entries are added to the report.

+

One important point about the evidence is that it is rated using different confidence levels - low, medium, high, and highest. These confidence levels are applied to each item of evidence. When the CPE is determined it is given a confidence level that is equal to the lowest level confidence level of evidence used during identification. If only highest confidence evidence was used in determining the CPE then the CPE would have a highest confidence level.

+

Because of the way dependency-check works both false positives and false negatives may exist. Please read How to read the report to get a better understanding of sorting through the false positives and false negatives.

+

Dependency-check does not currently use file hashes for identification. If the dependency was built from source the hash likely will not match the “published” hash. While the evidence based mechanism currently used can also be unreliable the design decision was to avoid maintaining a hash database of known vulnerable libraries. A future enhancement may add some hash matching for very common well known libraries (Spring, Struts, etc.).

+
+
+
+ +
+ + + + diff --git a/issue-tracking.html b/issue-tracking.html index 719a96c92..45078abff 100644 --- a/issue-tracking.html +++ b/issue-tracking.html @@ -1,13 +1,13 @@ - + dependency-check - Issue Tracking @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/jar-analyzer.html b/jar-analyzer.html index 5c926547d..77be6764d 100644 --- a/jar-analyzer.html +++ b/jar-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Jar Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -87,6 +87,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -150,13 +164,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -184,6 +191,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/license.html b/license.html index b645e609c..f32462d20 100644 --- a/license.html +++ b/license.html @@ -1,13 +1,13 @@ - + dependency-check - Project License @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/mail-lists.html b/mail-lists.html index 79dcc77a4..9eadcc7c8 100644 --- a/mail-lists.html +++ b/mail-lists.html @@ -1,13 +1,13 @@ - + dependency-check - Project Mailing Lists @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/modules.html b/modules.html index 598a2e727..a0884dc12 100644 --- a/modules.html +++ b/modules.html @@ -1,13 +1,13 @@ - + dependency-check - Project Modules @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • @@ -293,22 +314,22 @@ Description Dependency-Check Core -dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. +dependency-check-core is the engine and reporting tool used to identify and report if there are any known, publicly disclosed vulnerabilities in the scanned project's dependencies. The engine extracts meta-data from the dependencies and uses this to do fuzzy key-word matching against the Common Platfrom Enumeration (CPE), if any CPE identifiers are found the associated Common Vulnerability and Exposure (CVE) entries are added to the generated report. Dependency-Check Command Line -Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +dependency-check-cli is an command line tool that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the scanned project dependencies. The tool will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. Dependency-Check Ant Task -Dependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +dependency-check-ant is an Ant Task that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The task will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. Dependency-Check Maven Plugin -Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +dependency-check-maven is a Maven Plugin that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. Dependency-Check Jenkins Plugin -This plug-in can independently execute a Dependency-Check analysis and visualize the results. +dependency-check-jenkins is a Jenkins plugin that runs dependency-check-core on a project to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries. This module is simply a placeholder and does not contain the actual plugin source code. The source code and distribution of the plugin is handled via https://github.com/jenkinsci/dependency-check-jenkins and Jenkin's plugin management. Dependency-Check Utils -Dependency-check-utils a collection of common utlity classes used within dependency-check. +dependency-check-utils is a collection of common utlity classes used within dependency-check that might be useful in other projects. diff --git a/nexus-analyzer.html b/nexus-analyzer.html index 23c69ad5b..71e2af270 100644 --- a/nexus-analyzer.html +++ b/nexus-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Nexus Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -87,6 +87,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -150,13 +164,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -184,6 +191,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/nuspec-analyzer.html b/nuspec-analyzer.html index 9dabb0075..634f9ed78 100644 --- a/nuspec-analyzer.html +++ b/nuspec-analyzer.html @@ -1,13 +1,13 @@ - + dependency-check - Nuspec Analyzer @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -87,6 +87,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -150,13 +164,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -184,6 +191,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/project-info.html b/project-info.html index 4fae81d72..43eccc2cb 100644 --- a/project-info.html +++ b/project-info.html @@ -1,13 +1,13 @@ - + dependency-check - Project Information @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • @@ -295,7 +316,7 @@ Description About -dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. +dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. Project Summary This document lists other related information of this project diff --git a/project-summary.html b/project-summary.html index 6beea473d..e869da746 100644 --- a/project-summary.html +++ b/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check - Project Summary @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • @@ -297,7 +318,7 @@ Dependency-Check Description -dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. +dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. Homepage https://github.com/jeremylong/DependencyCheck.git @@ -327,7 +348,7 @@ dependency-check-parent Version -1.2.3 +1.2.4 Type pom diff --git a/source-repository.html b/source-repository.html index 72a530452..54ac3d9a1 100644 --- a/source-repository.html +++ b/source-repository.html @@ -1,13 +1,13 @@ - + dependency-check - Source Repository @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/suppression.html b/suppression.html index 20a0cb9c6..357177cc5 100644 --- a/suppression.html +++ b/suppression.html @@ -1,13 +1,13 @@ - + dependency-check - Suppressing False Positives @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -87,6 +87,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • False Positives @@ -150,13 +164,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -184,6 +191,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • diff --git a/team-list.html b/team-list.html index a7362952e..d82e2a1a1 100644 --- a/team-list.html +++ b/team-list.html @@ -1,13 +1,13 @@ - + dependency-check - Team list @@ -62,9 +62,9 @@ -
  • | Last Published: 2014-06-27
  • +
  • | Last Published: 2014-08-05
  • - Version: 1.2.3 + Version: 1.2.4
  • @@ -143,6 +143,20 @@ +
  • + + + + How it Works +
  • + +
  • + + + + Reading the Report +
  • +
  • @@ -208,13 +222,6 @@
  • -
  • - - - - dependency-check-core -
  • -
  • @@ -242,6 +249,20 @@ dependency-check-jenkins
  • + +
  • + + + + dependency-check-core +
  • + +
  • + + + + dependency-check-utils +
  • @@ -301,13 +322,13 @@ Roles Properties - + Jeremy Long jeremy.long@owasp.org OWASP https://www.owasp.org/index.php/OWASP_Dependency_Check architect, developer -picUrl=https://s.gravatar.com/avatar/46ac8812f5faccc721c4f198dce688be?s=240, twitter=@ctxt +picUrl=https://plus.google.com/s2/photos/profile/108968019311857145023, twitter=@ctxt Steve Springett diff --git a/thereport.html b/thereport.html new file mode 100644 index 000000000..15f7efb2f --- /dev/null +++ b/thereport.html @@ -0,0 +1,278 @@ + + + + + + + + + dependency-check - How To Read The Report + + + + + + + + + + + + + + + + + + + + + Fork me on GitHub + + + + + +
    + + + + + +
    +
    + +
    + + +
    + +

    How To Read The Report

    +

    There is a lot of information contained in the HTML version of the report. When analyzing the results, the first thing one should do is determine if the CPE looks appropriate. Due to the way dependency-check works (see above) the report may contain false positives; these false positives are primarily on the CPE values. If the CPE value is wrong, this is usually obvious and one should use the suppression feature in the report to generate a suppression XML file that can be used on future scans. In addition to just looking at the CPE values in comparison to the name of the dependency - one may also consider the confidence of the CPE (as discussed in How does dependency-check work). See the (Suppression False Positives)[./suppression.html] page for more information on how to generate and use the suppression file.

    +

    Once you have weeded out any obvious false positives one can then look at the remaining entries and determine if any of the identified CVE entries are actually exploitable in your environment. Determining if a CVE is exploitable in your environment can be tricky - for this I do not currently have any tips other then upgrade the library if you can just to be safe. Note, some CVE entries can be fixed by either upgrading the library or changing configuration options.

    +

    One item that dependency-check flags that many may think is a false positive are old database drivers. One thing to consider about an old database driver is that the CPE/CVEs identified are usually for the server rather then the driver. However, the presence of an old driver may indicate that you have an older version of the server running in your environment and that server may need to be patched or upgraded. However, in some cases the old database drivers are actually unused, transitive dependencies from other dependencies.

    +

    Regarding False Negatives

    +

    As stated above, due to the nature of dependency-check there may be publicly disclosed vulnerabilities in the project dependencies scanned by dependency-check that are not identified. With the current version of dependency-check the HTML report has a table at the top that initially displays just the dependencies with identified vulnerabilities. This can be toggled to show all dependencies. If you examine the rows that do not have identified CPE/CVE entries you will see an “evidence count”. If the evidence count is extremely low (0-5 entries) then there may not have been enough information contained in the dependency to identify a CPE and associated CVEs.

    +

    It should be noted that while the false positives described above are bad, more concerning is that there may be vulnerabilities within the project dependencies that have yet to be publicly known. If one has the resources consider performing security assessments on the project dependencies.

    +
    +
    +
    + +
    + + + +