Tool overview
OWASP Dependency-Check is a free and open-source software composition analysis tool that helps identify known vulnerabilities within the dependencies of a project. It can be used to analyze a wide range of software package types, including Java, .NET, Ruby, Python, and Node.js, among others. Dependency-Check works by scanning project dependencies and comparing them to a database of known vulnerabilities and Common Vulnerabilities and Exposures (CVE) identifiers.
The tool can be integrated into various stages of the software development lifecycle, including continuous integration/continuous delivery (CI/CD) pipelines, build systems, and development environments. It can generate reports in various formats, such as HTML, CSV, JSON, and XML, allowing developers to easily view and prioritize identified vulnerabilities based on their severity.
Dependency-Check also supports several popular build systems, such as Apache Maven, Gradle, and Ant, and integrates with several popular development environments, including Eclipse, IntelliJ IDEA, and Visual Studio. Additionally, it can be used as a command-line tool or integrated into other security tools and scanners. The OWASP community regularly updates the vulnerability database used by Dependency-Check, ensuring that it remains up-to-date with the latest known vulnerabilities.
OWASP Dependency-Check capabilities
- Support for multiple programming languages: Dependency-Check supports a wide range of programming languages including Java, .NET, Ruby, Python, JavaScript, and more.
- Multiple vulnerability databases: Dependency-Check can access multiple vulnerability databases, including the National Vulnerability Database (NVD), the RetireJS database, and the Node Security Project database.
- Integration with build systems: Dependency-Check can be integrated into build systems like Jenkins, Gradle, and Maven to automatically scan dependencies as part of the build process.
- Command-line interface: Dependency-Check also offers a command-line interface for use outside of build systems.
- Extensible reporting: Dependency-Check can generate reports in various formats such as HTML, CSV, JSON, and XML. It can also be integrated with other tools for enhanced reporting capabilities.
-
False positive suppression: Dependency-Check provides an easy way to suppress false positives by using a suppression file.
