Fork me on GitHub

Configuration

The dependency-check-update task downloads and updates the local copy of the NVD. There are several reasons that one may want to use this task; primarily, creating an update that will be run only once a day or once every few days (but not greater than 7 days) and then use the autoUpdate="false" setting on individual dependency-check scans. See Internet Access Required for more information on why this task would be used.

<target name="dependency-check-update" description="Dependency-Check Update">
    <dependency-check-update />
</target>

Configuration: dependency-check-update Task

The following properties can be set on the dependency-check task.

Property Description Default Value
proxyServer The Proxy Server.  
proxyPort The Proxy Port.  
proxyUsername Defines the proxy user name.  
proxyPassword Defines the proxy password.  
connectionTimeout The URL Connection Timeout.  
failOnError Whether the build should fail if there is an error executing the update true

Advanced Configuration

The following properties can be configured in the plugin. However, they are less frequently changed. One exception may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment.

Property Description Default Value
cveUrl12Modified URL for the modified CVE 1.2. https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-modified.xml.gz
cveUrl20Modified URL for the modified CVE 2.0. https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-Modified.xml.gz
cveUrl12Base Base URL for each year’s CVE 1.2, the %d will be replaced with the year. https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-%d.xml.gz
cveUrl20Base Base URL for each year’s CVE 2.0, the %d will be replaced with the year. https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz
dataDirectory Data directory that is used to store the local copy of the NVD. This should generally not be changed. data
databaseDriverName The name of the database driver. Example: org.h2.Driver.  
databaseDriverPath The path to the database driver JAR file; only used if the driver is not in the class path.  
connectionString The connection string used to connect to the database.  
databaseUser The username used when connecting to the database.  
databasePassword The password used when connecting to the database.