Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Facing an issue while scanning with OWASP Dependency Check 11.1.1 #7462

Closed
sadhanasabne opened this issue Feb 24, 2025 · 6 comments
Closed

Comments

@sadhanasabne
Copy link

following is an error message getting while scanning with OWASP Dependency Check 11.1.0. Please help me to resolve an error.
""
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:397)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:117)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:637)
at org.owasp.dependencycheck.App.runScan(App.java:266)
at org.owasp.dependencycheck.App.run(App.java:198)
at org.owasp.dependencycheck.App.main(App.java:90)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Failed to parse NVD data
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next(NvdCveClient.java:363)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:353)
... 7 common frames omitted
Caused by: com.fasterxml.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ModifiedCiaType, problem: SAFETY
at [Source: REDACTED (StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION disabled); line: 1, column: 3175185] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20["vulnerabilities"]->java.util.ArrayList[1471]->io.github.jeremylong.openvulnerability.client.nvd.DefCveItem["cve"]->io.github.jeremylong.openvulnerability.client.nvd.CveItem["metrics"]->io.github.jeremylong.openvulnerability.client.nvd.Metrics["cvssMetricV40"]->java.util.ArrayList[0]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4["cvssData"]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data["modifiedSubsequentSystemIntegrity"])

""

Image

@marcelstoer
Copy link
Collaborator

Dup of #7406

@sadhanasabne
Copy link
Author

Hey, I am facing issue on windows system, scanning with OWASP dependency check bin file and you provided thread of docker.

please help me with the solution.

@jeremylong
Copy link
Collaborator

jeremylong commented Feb 24, 2025

Weird - docker and the bin running on windows must be completely different. Or maybe @marcelstoer actually knows what he is talking about. Try reading #7406 or better #7463.

@marcelstoer
Copy link
Collaborator

Well, the description says

while scanning with OWASP Dependency Check 11.1.0

As I am not aware of any other issue around the SAFETY value I concluded this must be a dup.

@sadhanasabne sadhanasabne changed the title Facing an issue while scanning with OWASP Dependency Check 11.1.0 Facing an issue while scanning with OWASP Dependency Check 11.1.1 Feb 24, 2025
@sadhanasabne
Copy link
Author

by using 12.1.0 version and java 11 getting such output, help me with resolution:

Image

@sadhanasabne
Copy link
Author

what is OWASP dependency Check Core 12.1.0, is this resolve my issue? I have windows platform.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants