Integrate OWASP Dependency Check

[kotakanbe]

Usage: Integrate with OWASP Dependency Check to Automatic update when the libraries are updated (Experimental)

OWASP Dependency check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities.

Benefit of integrating Vuls And OWASP Dependency Check is below.

• Automatic Update of Vuls config when the libraries are updated.
• Reporting by Email or Slack by using Vuls.
• Reporting in Japanese
  • OWASP Dependency Check supports only English

How to integrate Vuls with OWASP Dependency Check

• Execute OWASP Dependency Check with --format=XML option.

• Define the xml file path of dependency check in config.toml.

  [servers]
  
  [servers.172-31-4-82]
  host         = "172.31.4.82"
  user        = "ec2-user"
  keyPath     = "/home/username/.ssh/id_rsa"
  dependencyCheckXMLPath = "/tmp/dependency-check-report.xml"
  

[kotakanbe]

I talked about this P/R at Security-JAWS#3

The Slide is here(in English).
Integrate Vuls with OWASP Dependency Check. To enable automatic update of vuls config when the programming language libraries are update.
http://qiita.com/kotakanbe@github/items/58a720c1028c1c23346b