dependency-check / dependency-check/DependencyCheck

Maven Plugin is failing the build on the basis of CvssV3 score

Open
#2,462 4 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
Maven Plugin 5.3.0 is failing maven build w.r.t CvssV3 score instead of CvssV2 score.

**Version of dependency-check used**
5.3.0

**Log file**
[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0':
[ERROR]
[ERROR] spring-security-core-4.2.0.RELEASE.jar: CVE-2018-1258, CVE-2017-4995, CVE-2016-9879, CVE-2019-11272
[ERROR] spring-core-4.3.4.RELEASE.jar: CVE-2018-1272, CVE-2018-1275, CVE-2016-9878, CVE-2018-1270, CVE-2018-15756

**To Reproduce**
Steps to reproduce the behavior:
1. Add below dependency in pom.xml

org.springframework.security
spring-security-core
4.2.0.RELEASE

2. Run org.owasp:dependency-check-maven:5.3.0:check -DfailBuildOnCVSS="7" -Dformat="JSON" on the maven project

**Expected behavior**
I assumed the failBuildOnCVSS will consider only Cvssv2 score for failing the build like old depndency-check versions. But in above example, the build failed due to the cvssv3 score.

How can I make the plugin to only consider specific scoring system for failing the build?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.