OWASP Dependency-Check: check a Java dependency for a CVE
Check a Java dependency for a CVE.
1. Run the example
Download the OWASP Dependency-Check example. Extract it, install httpx, set your API URL and token, then run python client.py. The client uploads the included inputs, submits the command, and saves the result under results/RUN_ID.
2. Check the result
Read report.json for the dependency and vulnerability match from the isolated NVD data source.
Read the native exit code and cleanup status printed by the client. Read results and save reports explains the returned files.
3. Use your own inputs
Edit example.json to change the command arguments, requested outputs or deadline. Replace the files under inputs/ with your own data, keeping the staged paths aligned with the command. The client creates the artifact IDs for you; illustrative IDs shown here must not be copied into a live request.
Files used by this example
deps/log4j-core-2.14.1.jar
This example selects the isolated nvd-fixture target. To use a reachable target of your own, change the target arguments or driver and remove target_profile. See Run a check against a target for network setup.
Commands, version and prerequisites
Qualified version: 13.0.0. Commands: dependency-check.
- Supply a prepared vulnerability database or a reachable NVD endpoint/feed. Optional online analyzers require their own endpoints and credentials.
Inspect GET /v1/tools/dependency-check for the current installed version and readiness. The published snapshot has 2 functional case(s), plus timeout and cancellation checks. These examples demonstrate the native path; other flags and inputs are supported within the tool’s runtime limits.