2

I am currently using dependency checker to scan my applications via gitlab

This is how my pipeline looks like.

dependency_scanning:
  stage: security_scan
  script:
    # Run dependency check on all modules
    - mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
  artifacts:
    paths:
      - ./target/dependency-check-report.html
  only:
    - master

And this is my output.

Executing "step_script" stage of the job script
00:32
$ mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
3304 [INFO] Scanning for projects...
4813 [INFO] 
4813 [INFO] --------------------< com.example:pipeline-tester >---------------------
4814 [INFO] Building demo 0.0.1-SNAPSHOT
4814 [INFO] --------------------------------[ jar ]---------------------------------
6018 [INFO] 
6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
12434 [INFO] Checking for updates
12494 [INFO] Skipping NVD check since last check was within 4 hours.
12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
12499 [INFO] Check for updates complete (64 ms)
12577 [INFO] 
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
   About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
   False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
💖 Sponsor: https://github.com/sponsors/jeremylong
12579 [INFO] Analysis Started
14108 [INFO] Finished Archive Analyzer (1 seconds)
14113 [INFO] Finished File Name Analyzer (0 seconds)
16312 [INFO] Finished Jar Analyzer (2 seconds)
16401 [INFO] Finished Dependency Merging Analyzer (0 seconds)
16405 [INFO] Finished Version Filter Analyzer (0 seconds)
16811 [INFO] Finished Hint Analyzer (0 seconds)
22504 [INFO] Created CPE Index (5 seconds)
28005 [INFO] Finished CPE Analyzer (11 seconds)
28010 [INFO] Finished False Positive Analyzer (0 seconds)
28609 [INFO] Finished NVD CVE Analyzer (0 seconds)
29109 [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
29522 [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
29606 [INFO] Finished Dependency Bundling Analyzer (0 seconds)
29908 [INFO] Analysis Complete (17 seconds)
30206 [INFO] Writing report to: /builds/cdit/pipeline-tester/target/dependency-check-report.html
31205 [WARNING] 
One or more dependencies were identified with known vulnerabilities in demo:
tomcat-embed-core-9.0.46.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46, cpe:2.3:a:apache:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_software_foundation:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.46:*:*:*:*:*:*:*) : CVE-2021-33037
See the dependency-check report for more details.
31513 [INFO] ------------------------------------------------------------------------
31514 [INFO] BUILD SUCCESS
31514 [INFO] ------------------------------------------------------------------------
31514 [INFO] Total time:  28.305 s
31514 [INFO] Finished at: 2021-08-12T07:20:28Z
31514 [INFO] ------------------------------------------------------------------------
Saving cache for successful job
00:01
Creating cache master...
.m2/repository: found 3366 matching files and directories 
Archive is up to date!                             
Created cache
Uploading artifacts for successful job
00:00
Uploading artifacts...
./target/dependency-check-report.html: found 1 matching files and directories 
Uploading artifacts as "archive" to coordinator... ok  id=335682 responseStatus=201 Created token=Bf8rx3gp
Cleaning up file based variables
00:00
Job succeeded

Is it possible to make my pipeline fail even though it is success, in this case when vulnerabilities are present?

1
  • 2
    A a very general tip, exit 1 (or any non 0 rc) anywhere in you pipeline should fail it. So you could detect what comes back from your previous command and exit with error when need be. Meanwhile, I'm not very familiar with the maven dependency-check plugin, but I'm quite sure you have a configuration option or a specific way to call it that will let it exit with an error code itself if a vulnerability is found. Aug 20 '21 at 12:50
1

All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.

You can do that with the failBuildOnCVSS config flag. E.g. with severity 8 from docs

<project>
    ...
    <build>
        ...
        <plugins>
            ...
            <plugin>
              <groupId>org.owasp</groupId>
              <artifactId>dependency-check-maven</artifactId>
              <version>6.2.2</version>
              <configuration>
                  <failBuildOnCVSS>8</failBuildOnCVSS>
              </configuration>
              <executions>
                  <execution>
                      <goals>
                          <goal>check</goal>
                      </goals>
                  </execution>
              </executions>
            </plugin>
            ...
        </plugins>
        ...
    </build>
    ...
</project>

By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.