dependency-check / dependency-check/DependencyCheck
Maven Plugin is failing the build on the basis of CvssV3 score
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
Maven Plugin 5.3.0 is failing maven build w.r.t CvssV3 score instead of CvssV2 score.
**Version of dependency-check used**
5.3.0
**Log file**
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-security-core-4.2.0.RELEASE.jar: CVE-2018-1258, CVE-2017-4995, CVE-2016-9879, CVE-2019-11272
[ERROR] spring-core-4.3.4.RELEASE.jar: CVE-2018-1272, CVE-2018-1275, CVE-2016-9878, CVE-2018-1270, CVE-2018-15756
**To Reproduce**
Steps to reproduce the behavior:
1. Add below dependency in pom.xml
org.springframework.security
spring-security-core
4.2.0.RELEASE
2. Run org.owasp:dependency-check-maven:5.3.0:check -DfailBuildOnCVSS="7" -Dformat="JSON" on the maven project
**Expected behavior**
I assumed the failBuildOnCVSS will consider only Cvssv2 score for failing the build like old depndency-check versions. But in above example, the build failed due to the cvssv3 score.
How can I make the plugin to only consider specific scoring system for failing the build?
Contributor guide
Assessment
This issue has not been assessed yet.