What to do when Owasp dependency finds vulnerabilities

Question

I want to ask, that what to do when Owasp dependency-check finds vulnerabilities.

I've recently deployed to a project and I'm a fresher, so I don't know what to do.

I've got a list of dependency those are vulnerabilities so how to find the stable one so that I can update that.

Here is the error.

One or more dependencies were identified with known vulnerabilities in <Project-name>:

commons-beanutils-1.9.4.jar (pkg:maven/commons-beanutils/commons-beanutils@1.9.4, cpe:2.3:a:apache:commons_beanutils:1.9.4:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_net:1.9.4:*:*:*:*:*:*:*) : CVE-2021-37533
commons-cli-1.4.jar (pkg:maven/commons-cli/commons-cli@1.4, cpe:2.3:a:apache:commons_net:1.4:*:*:*:*:*:*:*) : CVE-2021-37533
commons-codec-1.11.jar (pkg:maven/commons-codec/commons-codec@1.11, cpe:2.3:a:apache:commons_net:1.11:*:*:*:*:*:*:*) : CVE-2021-37533
commons-codec-1.15.jar (pkg:maven/commons-codec/commons-codec@1.15, cpe:2.3:a:apache:commons_net:1.15:*:*:*:*:*:*:*) : CVE-2021-37533
commons-collections-3.2.2.jar (pkg:maven/commons-collections/commons-collections@3.2.2, cpe:2.3:a:apache:commons_collections:3.2.2:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_net:3.2.2:*:*:*:*:*:*:*) : CVE-2021-37533
commons-fileupload-1.4.jar (pkg:maven/commons-fileupload/commons-fileupload@1.4, cpe:2.3:a:apache:commons_fileupload:1.4:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_net:1.4:*:*:*:*:*:*:*) : CVE-2021-37533
commons-io-2.6.jar (pkg:maven/commons-io/commons-io@2.6, cpe:2.3:a:apache:commons_net:2.6:*:*:*:*:*:*:*) : CVE-2021-37533
commons-io-2.7.jar (pkg:maven/commons-io/commons-io@2.7, cpe:2.3:a:apache:commons_io:2.7:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_net:2.7:*:*:*:*:*:*:*) : CVE-2021-37533
commons-lang-2.4.jar (pkg:maven/commons-lang/commons-lang@2.4, cpe:2.3:a:apache:commons_net:2.4:*:*:*:*:*:*:*) : CVE-2021-37533
commons-logging-1.2.jar (pkg:maven/commons-logging/commons-logging@1.2, cpe:2.3:a:apache:commons_net:1.2:*:*:*:*:*:*:*) : CVE-2021-37533
commons-text-1.7.jar (pkg:maven/org.apache.commons/commons-text@1.7, cpe:2.3:a:apache:commons_net:1.7:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_text:1.7:*:*:*:*:*:*:*) : CVE-2021-37533, CVE-2022-42889
jackson-databind-2.11.4.jar (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.11.4, cpe:2.3:a:fasterxml:jackson-databind:2.11.4:*:*:*:*:*:*:*) : CVE-2022-42003, CVE-2022-42004
lang-tag-1.4.4.jar (pkg:maven/com.nimbusds/lang-tag@1.4.4, cpe:2.3:a:nim-lang:nim-lang:1.4.4:*:*:*:*:*:*:*, cpe:2.3:a:tag_project:tag:1.4.4:*:*:*:*:*:*:*) : CVE-2020-29242, CVE-2020-29243, CVE-2020-29244, CVE-2020-29245
logstash-logback-encoder-5.3.jar/META-INF/maven/commons-lang/commons-lang/pom.xml (pkg:maven/commons-lang/commons-lang@2.6, cpe:2.3:a:apache:commons_net:2.6:*:*:*:*:*:*:*) : CVE-2021-37533
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-buffer/pom.xml (pkg:maven/io.netty/netty-buffer@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-codec-dns/pom.xml (pkg:maven/io.netty/netty-codec-dns@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-codec-http/pom.xml (pkg:maven/io.netty/netty-codec-http@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-codec-socks/pom.xml (pkg:maven/io.netty/netty-codec-socks@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-codec/pom.xml (pkg:maven/io.netty/netty-codec@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-common/pom.xml (pkg:maven/io.netty/netty-common@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-handler-proxy/pom.xml (pkg:maven/io.netty/netty-handler-proxy@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-handler/pom.xml (pkg:maven/io.netty/netty-handler@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-resolver-dns-classes-macos/pom.xml (pkg:maven/io.netty/netty-resolver-dns-classes-macos@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-resolver-dns-native-macos/pom.xml (pkg:maven/io.netty/netty-resolver-dns-native-macos@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-resolver-dns/pom.xml (pkg:maven/io.netty/netty-resolver-dns@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-resolver/pom.xml (pkg:maven/io.netty/netty-resolver@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-transport-classes-epoll/pom.xml (pkg:maven/io.netty/netty-transport-classes-epoll@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-transport-native-epoll/pom.xml (pkg:maven/io.netty/netty-transport-native-epoll@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-transport-native-unix-common/pom.xml (pkg:maven/io.netty/netty-transport-native-unix-common@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
micrometer-registry-statsd-1.8.1.jar/META-INF/maven/io.netty/netty-transport/pom.xml (pkg:maven/io.netty/netty-transport@4.1.70.Final, cpe:2.3:a:netty:netty:4.1.70:*:*:*:*:*:*:*) : CVE-2021-43797, CVE-2022-24823
postgresql-42.2.18.jar (pkg:maven/org.postgresql/postgresql@42.2.18, cpe:2.3:a:postgresql:postgresql:42.2.18:*:*:*:*:*:*:*, cpe:2.3:a:postgresql:postgresql_jdbc_driver:42.2.18:*:*:*:*:*:*:*) : CVE-2022-31197, CVE-2022-41946
scala-library-2.13.4.jar (pkg:maven/org.scala-lang/scala-library@2.13.4, cpe:2.3:a:scala-lang:scala:2.13.4:*:*:*:*:*:*:*) : CVE-2022-36944
scala-reflect-2.13.2.jar (pkg:maven/org.scala-lang/scala-reflect@2.13.2, cpe:2.3:a:scala-lang:scala:2.13.2:*:*:*:*:*:*:*) : CVE-2022-36944
snakeyaml-1.27.jar (pkg:maven/org.yaml/snakeyaml@1.27, cpe:2.3:a:snakeyaml_project:snakeyaml:1.27:*:*:*:*:*:*:*, cpe:2.3:a:yaml_project:yaml:1.27:*:*:*:*:*:*:*) : CVE-2022-25857, CVE-2022-38749, CVE-2022-38750, CVE-2022-38751, CVE-2022-38752, CVE-2022-41854
spring-security-config-5.4.9.jar (pkg:maven/org.springframework.security/spring-security-config@5.4.9, cpe:2.3:a:pivotal_software:spring_security:5.4.9:*:*:*:*:*:*:*) : CVE-2018-1258
spring-security-core-5.4.9.jar (pkg:maven/org.springframework.security/spring-security-core@5.4.9, cpe:2.3:a:pivotal_software:spring_security:5.4.9:*:*:*:*:*:*:*) : CVE-2018-1258
spring-security-crypto-5.4.9.jar (pkg:maven/org.springframework.security/spring-security-crypto@5.4.9, cpe:2.3:a:pivotal_software:spring_security:5.4.9:*:*:*:*:*:*:*) : CVE-2018-1258
spring-security-web-5.4.9.jar (pkg:maven/org.springframework.security/spring-security-web@5.4.9, cpe:2.3:a:pivotal_software:spring_security:5.4.9:*:*:*:*:*:*:*) : CVE-2018-1258
tomcat-embed-core-9.0.54.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.54, cpe:2.3:a:apache:tomcat:9.0.54:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.54:*:*:*:*:*:*:*) : CVE-2021-43980, CVE-2022-34305, CVE-2022-42252
tomcat-embed-websocket-9.0.55.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-websocket@9.0.55, cpe:2.3:a:apache:tomcat:9.0.55:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.55:*:*:*:*:*:*:*) : CVE-2021-43980, CVE-2022-34305, CVE-2022-42252
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/com.fasterxml.jackson.core/jackson-databind/pom.xml (pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.12.3, cpe:2.3:a:fasterxml:jackson-databind:2.12.3:*:*:*:*:*:*:*) : CVE-2022-42003, CVE-2022-42004
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/commons-io/commons-io/pom.xml (pkg:maven/commons-io/commons-io@2.9.0, cpe:2.3:a:apache:commons_io:2.9.0:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_net:2.9.0:*:*:*:*:*:*:*) : CVE-2021-37533
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.apache.commons/commons-lang3/pom.xml (pkg:maven/org.apache.commons/commons-lang3@3.8.1, cpe:2.3:a:apache:commons_net:3.8.1:*:*:*:*:*:*:*) : CVE-2021-37533
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.apache.commons/commons-text/pom.xml (pkg:maven/org.apache.commons/commons-text@1.6, cpe:2.3:a:apache:commons_net:1.6:*:*:*:*:*:*:*, cpe:2.3:a:apache:commons_text:1.6:*:*:*:*:*:*:*) : CVE-2021-37533, CVE-2022-42889
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty.http2/http2-common/pom.xml (pkg:maven/org.eclipse.jetty.http2/http2-common@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty.http2/http2-server/pom.xml (pkg:maven/org.eclipse.jetty.http2/http2-server@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty_http_server:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-alpn-client/pom.xml (pkg:maven/org.eclipse.jetty/jetty-alpn-client@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-alpn-conscrypt-client/pom.xml (pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-client@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-alpn-conscrypt-server/pom.xml (pkg:maven/org.eclipse.jetty/jetty-alpn-conscrypt-server@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-alpn-server/pom.xml (pkg:maven/org.eclipse.jetty/jetty-alpn-server@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-client/pom.xml (pkg:maven/org.eclipse.jetty/jetty-client@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-continuation/pom.xml (pkg:maven/org.eclipse.jetty/jetty-continuation@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-http/pom.xml (pkg:maven/org.eclipse.jetty/jetty-http@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-security/pom.xml (pkg:maven/org.eclipse.jetty/jetty-security@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-server/pom.xml (pkg:maven/org.eclipse.jetty/jetty-server@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-servlet/pom.xml (pkg:maven/org.eclipse.jetty/jetty-servlet@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-servlets/pom.xml (pkg:maven/org.eclipse.jetty/jetty-servlets@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-util-ajax/pom.xml (pkg:maven/org.eclipse.jetty/jetty-util-ajax@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-util/pom.xml (pkg:maven/org.eclipse.jetty/jetty-util@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-webapp/pom.xml (pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048
wiremock-jre8-standalone-2.28.1.jar/META-INF/maven/org.eclipse.jetty/jetty-xml/pom.xml (pkg:maven/org.eclipse.jetty/jetty-xml@9.4.41.v20210516, cpe:2.3:a:eclipse:jetty:9.4.41:20210516:*:*:*:*:*:*, cpe:2.3:a:jetty:jetty:9.4.41:20210516:*:*:*:*:*:*) : CVE-2022-2047, CVE-2022-2048


See the dependency-check report for more details.

Help will be highly appreciated.

Thanks

I'm expecting any suggestion for the next step

You should read the CVEs that are mentioned at the end of each line. They usually contain the needed remediation. — Federico klez Culloca, Dec 12 '22 at 10:36

Adrian B. · Answer 1 · 2022-12-12T10:40:55.557

We don't have sufficient context for this, so I'm going to assume we're talking about Maven and it's dependency check plugin.

Any dependency found to be problematic. Use Mvn Repo to identify newer (not vulnerable) libs. I've added as an example the scala lib, and you can see a column with known vulnerabilities for it. pick one that is not vulnerable and update your pom.xml file with it. If you notive that Maven does not update the dependency based on whatever version you supply, it could be that you're getting a transitive dependency from somewhere else that's overriding you. to discover it, you can use mvn dependency:tree in a command line to see from where each version is resolved. And, if there's no other option, look into using dependencyManagement in your pom.xml to impose a specific version.

There is also the case that there is no vulnerability-free version available, in which case, you should either replace the library, or, if it's an acceptable risk, look into using suppression files (see example 7 in the plugin link above) for that particular CVE.

nvd.nist.gov is a very good site where you can find details about each individual CVE. You can find the CVE number at the end of each finding in your report. Search for it on this website and it should tell you if there is any special remediation to be done or even how to reproduce to find out if you're vulnerable.

What to do when Owasp dependency finds vulnerabilities

1 Answers1