OWASP Dependency-check Plug-in introduction and use

1. Dependency-check can check for known, publicly disclosed vulnerabilities in project dependency packages. Currently good support for Java and. NET; Ruby, node. js, andPython are in the experimental phase, and C + + is supported only through (autoconf and CMake). The owasp2017 Top10 is mainly available for a9-using components with known vulnerabilities. Solution to the problem

2, Dependency-check has command line interface, MAVEN plugin, Jenkins plug-ins and so on. The core function is to detect the dependencies of the project through a series of analyzers, collect dependent information, confirm the CPE by this information, and once the CPE is confirmed, the CVE (Comman Vulnerability and Exposure) can be listed.

3, the plug-in all public vulnerability information is stored in a huge list or database, you can download it to the local, to facilitate quick query; Remember to update this list or database regularly

　　

　　

The CPE full name is common Platform enumeration, which means generic platform enumeration entries. It is a naming method for identified software, operating systems, and hardware。 It currently has 2 formats, 2.2 and 2.3,2.2 in the following format: CPE:/H:HUAWEI:E200E-USG2100:V100R005C01Cpe:/<part>:<vendor>:<product>:<version>:<update>:<edition>:<language The >2.3 format is as follows: cpe:2.3:h:huawei:e200_usg2200:v200r003c00:*:*:*:*:*:*:*Cpe:<2.3>:<part>:<vendor>:<product>:<version>:<update>:<edition>: <language> where part represents the target type, the allowed values are a (application), H (Hardware platform), O (operating system), vendor is the name of the manufacturer, product is the name of the products, and version represents the update package 　　; edition represents a version; Language represents a language item. These seven items do not necessarily appear every time. For example, in cpe:/o:freebsd:freebsd:3.5.1, part is O, which indicates the operating system type; vendor is FreeBSD, which indicates that the vector type is freebsd;product FreeBSD, which indicates that the product is FreeBSD ; version is 3.5.1, which indicates the revision number of FreeBSD.

Reference:

1, Https://www.owasp.org/index.php/OWASP_Dependency_Check

2, https://jeremylong.github.io/DependencyCheck/index.html#

3, https://nvd.nist.gov/products/cpe/search/results?keyword=usg&status=final&orderby=cpeuri& namingformat=2.2

4.

OWASP Dependency-check Plug-in introduction and use