[MNG-6487] Adding CVE Checks via OWASP

• Type: Improvement
• Status: Open
• Priority: Minor
• Resolution: Unresolved
• Assignee: Unassigned
• Reporter: Karl Heinz Marbaise
• Created: 06/Oct/18 09:21
• Updated: 13/Nov/22 13:01

Description

mvn compile org.sonatype.ossindex.maven:ossindex-maven-plugin:audit

Result on all modules is a CVSS-score threshold: 0.0

In contrast: IIRC the owasp dependency plugin gave several false positives.

We should consider to add this to the maven-parent to get early notifications on known CVEs.

Issue Links

• is blocked by: MPOM-210 Adding CVE Checks via OWASP
• links to: GitHub Pull Request #858