[FIXED] CVE mapping to Java library

Issue

There is dependency-check-maven plugin which checks if 3rd party dependencies in my Java project have known vulnerability. The issue is that this plugin has lot of false positives (and quite likely false negatives) due to the fact that CVE does not contain unique identifier of the library. For example recent Spring vulnerability CVE-2018-1275 contains identifier cpe:2.3:a:pivotal_software:spring_framework:*:*:*:*:*:*:*:* versions from (including) 4.3.0 up to (excluding) 4.3.16 which is quite hard to map to exact Maven dependency. See this article for more details.

Is there is some openly accessible mapping between CVEs and Maven dependencies that would allow more reliable check?

Solution

There are 2 other options I know of. In alphabetical order:

• https://github.com/OSSIndex/ossindex-maven-plugin

• https://github.com/snyk/snyk-maven-plugin

Answered By - Robert Scholte
Answer Checked By - David Goodson (JavaFixing Volunteer)