demo地址

引入dependnecy-check插件

项目中原有的依赖是这样的

        
            io.netty
            netty-all
            4.1.41.Final
        

            org.owasp
            dependency-check-maven
            ${dependency-check-maven.version}
            
              
                src/owasp-dependency-check-suppressions.xml
              
              7
              false
              false
              false
              false
              false
              false
              false
              false
              false
              false
              false
              false
              true
            
            
              
                
                  aggregate
                
              
            
          

然后可以通过mvn clean install verify -DskipTests来检测。这个demo下，会输出

[ERROR] One or more dependencies were identified with vulnerabilities that have a CVSS score greater than or equal to '7.0': 
[ERROR] 
[ERROR] netty-all-4.1.41.Final.jar: CVE-2019-16869(7.5), CVE-2021-37136(7.5), CVE-2020-11612(7.5), CVE-2021-37137(7.5), CVE-2019-20445(9.1), CVE-2019-20444(9.1), CVE-2020-7238(7.5)
[ERROR] 
[ERROR] See the dependency-check report for more details.

实际使用时，由于dependency-check检查相对耗时，一般通过单独的profile来控制开关

屏蔽CVE漏洞

如果出现dependency-check误报或者是评估该漏洞不涉及，可以通过supression file来屏蔽

屏蔽单一CVE漏洞

  
    
    849e8ece2845cb0185d721233906d487a7f1e4cf
    CVE-2021-29425
  

通过文件正则来屏蔽CVE漏洞

    
        CVE-2011-1797 FP, see https://github.com/jeremylong/DependencyCheck/issues/4154
        .*netty-tcnative-boringssl-static.*\.jar
        CVE-2011-1797g