[MPOM-210] Adding CVE Checks via OWASP

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Won't Fix
• Affects Version/s: MAVEN-33
• Component/s: maven
• Assignee: Unassigned
• Reporter: Karl Heinz Marbaise
• Created: 06/Oct/18 17:59
• Updated: 14/Jul/21 15:43
• Resolved: 26/Jan/20 11:42

Description

We should add a configuration for CVS checks for example via OWASP maven plugin.

I think the first step should be add at least an entry in pluginManagement:

    <plugin>
              <groupId>org.owasp</groupId>
              <artifactId>dependency-check-maven</artifactId>
              <version>3.3.2</version>
  </plugin>

The other parts would be to add an entry for:

https://github.com/sonatype/ossindex-maven

which is not a good idea at the moment, cause it does not support JDK 10...

Issue Links

• blocks: MNG-6487 Adding CVE Checks via OWASP