You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@maven.apache.org by "jira-importer (via GitHub)" <gi...@apache.org> on 2025/03/06 09:31:30 UTC
[I] [MPOM-210] Adding CVE Checks via OWASP [maven-parent]
jira-importer opened a new issue, #249:
URL: https://github.com/apache/maven-parent/issues/249
**[Karl Heinz Marbaise](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=khmarbaise)** opened **[MPOM-210](https://issues.apache.org/jira/browse/MPOM-210?redirect=false)** and commented
We should add a configuration for CVS checks for example via OWASP maven plugin.
I think the first step should be add at least an entry in pluginManagement:
```
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>3.3.2</version>
</plugin>
```
The other parts would be to add an entry for:
https://github.com/sonatype/ossindex-maven
which is not a good idea at the moment, cause it does not support JDK 10...
---
**Affects:** MAVEN-33
**Issue Links:**
- [MNG-6487](https://issues.apache.org/jira/browse/MNG-6487) Adding CVE Checks via OWASP
(_**"blocks"**_)
0 votes, 5 watchers
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [MPOM-210] Adding CVE Checks via OWASP [maven-parent]
Posted by "bmarwell (via GitHub)" <gi...@apache.org>.
bmarwell closed issue #249: [MPOM-210] Adding CVE Checks via OWASP
URL: https://github.com/apache/maven-parent/issues/249
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [MPOM-210] Adding CVE Checks via OWASP [maven-parent]
Posted by "jira-importer (via GitHub)" <gi...@apache.org>.
jira-importer commented on issue #249:
URL: https://github.com/apache/maven-parent/issues/249#issuecomment-2703294083
**[Allen Wittenauer](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=aw)** commented
> I don't like the owasp plugin because of the noise (false positives) it can give.
We were trying to integrate it into Apache Yetus and the results were beyond ridiculous. My favorite was flagging pure Java projects with vulnerabilities from Apache httpd. Its quality level is highly questionable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [MPOM-210] Adding CVE Checks via OWASP [maven-parent]
Posted by "jira-importer (via GitHub)" <gi...@apache.org>.
jira-importer commented on issue #249:
URL: https://github.com/apache/maven-parent/issues/249#issuecomment-2703294077
**[Sylwester Lachiewicz](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=slachiewicz)** commented
Snyk looks interesting - I already configured my forks to run Snyk scan and receiving notifications every day.
Maybe we can setup Snyk for Maven's projects with Github and send notifications to the mailing list?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [MPOM-210] Adding CVE Checks via OWASP [maven-parent]
Posted by "jira-importer (via GitHub)" <gi...@apache.org>.
jira-importer commented on issue #249:
URL: https://github.com/apache/maven-parent/issues/249#issuecomment-2703294069
**[Robert Scholte](https://issues.apache.org/jira/secure/ViewProfile.jspa?name=rfscholte)** commented
I don't like the owasp plugin because of the noise (false positives) it can give. Better use the ossindex or snyk (however, that one requires an APItoken)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org