OWASP Dependency-Check Tutorial: Features, Use Cases, How It Works

TL;DR, What is OWASP Dependency-Check?

OWASP Dependency-Check is a free, open-source software composition analysis (SCA) tool that finds known vulnerabilities in your project dependencies. Manually tracking hundreds of third-party components for security flaws can be a huge challenge, exposing applications to risks from the OWASP Top 10. Dependency-Check automates the job by scanning libraries and checking them against the National Vulnerability Database. 

The tool integrates into your development pipeline with plugins for Jenkins, Maven, and Gradle, helping you find and fix vulnerable components early. A proactive approach to vulnerability management helps strengthen software supply chain security before your code reaches production. As a flagship project from the Open Web Application Security Project (OWASP), OWASP Dependency-Check is a trusted and actively maintained security tool.

Your Secure Coding Cheat Sheet

Strengthen your code and dependencies with essential secure coding practices. Download our cheat sheet to prevent vulnerabilities detected by SCA tools.

Your work email here

Download cheat sheet

At-A-Glance

• GitHub: https://github.com/dependency-check/DependencyCheck

• License: Apache-2.0

• Primary Language: Java

• Stars: 7.2k ⭐

• Last Release: v10.0.1 on July 25, 2024

• Topics/Tags: sca, software-composition-analysis, vulnerability-scanner, owasp, security

Common use cases

1. CI/CD Pipeline Integration: You can automate scans in CI/CD pipelines like Jenkins, GitHub Actions, or GitLab CI/CD to catch vulnerabilities early. You can configure builds to fail if severe issues are found, embedding security directly into the development workflow and stopping insecure deployments.

2. Security Baseline Assessment: Organizations run scans across their application portfolio to create a full inventory of third-party components. An established baseline helps you prioritize fixes, track risk over time, and meet compliance rules for vulnerability management.

3. Local Developer Scanning: Developers use the command-line tool to scan for vulnerabilities on their own machines before committing code. Taking this proactive step prevents insecure dependencies from entering the central repository and helps build a security-first mindset.

4. Container Image Security: You can use Dependency-Check to scan all layers of a container image, including application code and base OS packages. Using the tool ensures the entire software supply chain's security is validated before an image is stored in a registry or deployed.

5. Auditing and Compliance Reporting: The generated reports provide auditable evidence of a software composition analysis program. These reports create a clear inventory for compliance checks and document investigated findings through suppression files to support internal governance and external audits.

Catch code risks before you deploy

Learn how Wiz Code scans IaC, containers, and pipelines to stop misconfigurations and vulnerabilities before they hit your cloud.

Work Email*

First Name*

Last Name*

Country

Phone Number*

Company*

Keep me updated about Wiz product releases, industry news, and events (You can unsubscribe at any time)

Subscribe me to the Wiz blog digest emails

Submit

For information about how Wiz handles your personal data, please see our Privacy Policy.

Your work email here

Get a demo

How does OWASP Dependency-Check work?

OWASP Dependency-Check uses an evidence-based analysis engine. When a scan begins, a core orchestrator deploys specialized file type analyzers to look at project files like `pom.xml` or JARs. The analyzers extract identifying information—vendor, product, and version—from each dependency, creating a unique evidence profile. The engine then uses the collected evidence to find potential vulnerabilities by matching it against a locally cached database of known security issues from the National Vulnerability Database (NVD).

• Evidence Collection & Scoring: Analyzers gather details from manifests, filenames, and metadata. The engine assigns a confidence level (e.g., high, medium) to the "evidence," reflecting the reliability of its source.

• CPE Identification: A specialized CPE Analyzer compares the collected evidence against a local index of Common Platform Enumeration (CPE) identifiers, using fuzzy logic to find the best match for the component.

• Vulnerability Mapping: After identifying a dependency with a CPE, Dependency-Check queries its synchronized vulnerability database and other sources like OSS Index to find associated CVEs.

• Report Generation: Finally, the tool compiles all findings into a detailed report available in formats like HTML or JSON, which outlines discovered vulnerabilities and confidence levels.

Core Capabilities

1. Multi-Language Dependency Analysis: OWASP Dependency-Check performs software composition analysis (SCA) across many programming languages, including Java, .NET, Node.js, Python, and Ruby. The tool's specialized analyzers parse dependency metadata from build system files like `pom.xml` and `package.json` for open-source dependency scanning. Using the tool allows your organization to build a complete inventory of third-party components across different technology stacks.

2. Evidence-Based Vulnerability Identification: Instead of relying on simple file hashes, the tool uses an evidence-based engine. The engine collects vendor, product, and version information from various sources within a dependency, assigning confidence levels to each piece of evidence. A heuristic approach creates a more accurate Common Platform Enumeration (CPE) match, which reduces false positives and provides more reliable vulnerability results.

3. Vulnerability Database Integration: The tool improves its detection by gathering data from multiple sources beyond the National Vulnerability Database (NVD). Dependency-Check integrates with OSS Index, NPM Audit API, and others to provide broader and more timely vulnerability coverage. It also maintains a local database that you can synchronize for both online and offline environments, making sure your analysis is always based on current threat intelligence.

4. Flexible Integration and Deployment Options: Designed for DevSecOps, Dependency-Check integrates into any workflow. The tool offers a command-line interface, plugins for Maven and Gradle, a Jenkins plugin for CI/CD, and Ant tasks. This flexibility allows you to embed automated security scanning at multiple stages of the software development lifecycle, from a developer's local machine to the final build pipeline, which enables a “shift-left” approach.

5. Customizable Reporting and Suppression Management: The tool generates detailed reports in multiple formats (HTML, JSON, XML) that include CVE details and CVSS scores. Dependency-Check features a suppression system to manage false positives with an audit trail, ensuring they don't repeatedly break builds. You can configure build failure based on vulnerability severity thresholds, automating policy enforcement in your vulnerability management pipeline.

Limitations

1. Dependency on Upstream Vulnerability Databases: The tool's effectiveness depends on the timeliness of its data sources. A delay in CVE publication in the NVD creates a window of exposure where new vulnerabilities go undetected during scans.

2. Potential for False Positives: Heuristic analysis can misidentify obscure or customized libraries, which generates false positives. Handling these false positives requires manual investigation and maintenance of suppression files, adding overhead for development teams.

3. Performance Overhead in Large Projects: Initial scans on projects with deep dependency trees can be slow and may bottleneck CI/CD pipelines. You will need caching and careful configuration to reduce performance impacts on build times.

4. Focused Scope on Dependencies (SCA): As a dedicated SCA tool, Dependency-Check only finds vulnerabilities in third-party libraries. The tool does not analyze first-party code, so you'll need separate SAST/DAST tools for full application security coverage.

5. Database Maintenance Overhead: Maintaining the local vulnerability database needs a lot of disk space and regular updates. This maintenance adds operational complexity, especially in distributed environments where all build agents need consistent data.

Getting Started:

Step 1: Ensure Java 11 or higher is installed.

java -version

Step 2: Download the latest Dependency-Check CLI release.

VERSION=$(curl -s https://dependency-check.github.io/DependencyCheck/current.txt)

curl -Ls "https://github.com/dependency-check/DependencyCheck/releases/download/v$VERSION/dependency-check-$VERSION-release.zip" \
  --output dependency-check.zip

Step 3: Unzip the downloaded file.

unzip dependency-check.zip

Step 4 (Recommended): Obtain a free NVD API key
For faster vulnerability data retrieval, request a key here: https://nvd.nist.gov/developers/request-an-api-key

Step 5: Run Dependency-Check to verify installation.

./bin/dependency-check.sh -h

Step 6: Scan your project for vulnerable dependencies.

./bin/dependency-check.sh --out . --scan [path-to-your-project]

The tool will generate a report (for example: dependency-check-report.html) in the output directory you specified.

FAQ

Verified OWASP Dependency-Check User Reviews

• "We started using this recently after the 8000th Struts RCE vulnerability this year. I agree with the author, it's not an end-all-be-all security check, but it's a nice add. One thing to note is that it requires your project build to make external http requests which can slow down your build at best or break it randomly at worst. I've set this up as a separate daily job (could probably stand to do it weekly) instead of as part of the normal CI build & deploy." - [deleted] - [r/java]

• "A good approach is to not integrate this into your build pipeline, but into a separate app sec pipeline so it doesn't slow down builds or cover up other errors. If you have some form of CI/CD, make that dependant on whether both pipelines have been successful. This way you can still build artifacts (e.g. for internal repositories), but automatic deployment only takes place when there are no problems." - [0x442E472E] - [r/java]

Alternatives