[Commented] (MPOM-210) Adding CVE Checks via OWASP

classic Classic list List threaded Threaded
1 message Options
Reply | Threaded
Open this post in threaded view

[Commented] (MPOM-210) Adding CVE Checks via OWASP

JIRA jira@apache.org

    [ https://issues.apache.org/jira/browse/MPOM-210?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16647199#comment-16647199 ]

Sylwester Lachiewicz commented on MPOM-210:

Snyk looks interesting - I already configured my forks to run Snyk scan and receiving notifications every day.

Maybe we can setup Snyk for Maven's projects with Github and send notifications to the mailing list?

> Adding CVE Checks via OWASP
> ---------------------------
>                 Key: MPOM-210
>                 URL: https://issues.apache.org/jira/browse/MPOM-210
>             Project: Maven POMs
>          Issue Type: Improvement
>          Components: maven
>    Affects Versions: MAVEN-33
>            Reporter: Karl Heinz Marbaise
>            Priority: Critical
>             Fix For: MAVEN-34
> We should add a configuration for CVS checks for example via OWASP maven plugin.
> I think the first step should be add at least an entry in pluginManagement:
> {code}
>     <plugin>
>               <groupId>org.owasp</groupId>
>               <artifactId>dependency-check-maven</artifactId>
>               <version>3.3.2</version>
>   </plugin>
> {code}
> The other parts would be to add an entry for:
> https://github.com/sonatype/ossindex-maven
> which is not a good idea at the moment, cause it does not support JDK 10...

This message was sent by Atlassian JIRA