Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency-Check Core version 10.0.0 #6760

Closed
damu9618 opened this issue Jul 1, 2024 · 6 comments
Closed

Dependency-Check Core version 10.0.0 #6760

damu9618 opened this issue Jul 1, 2024 · 6 comments
Labels

Comments

@damu9618
Copy link

damu9618 commented Jul 1, 2024

Describe the bug
Updating CVE: CVE-2023-24015:
NVD API request failures are occurring; retrying request for the n time

Version of dependency-check used
Dependency-Check Core version 10.0.0 : CLI

Log file
347.txt

To Reproduce
Steps to reproduce the behavior:

  • task: dependency-check-build-task@6
    displayName: Run OWASP dependency check
    inputs:
    projectName: test
    scanPath: ${{ parameters.scanDirectory }}
    failOnCVSS: 7
    format: HTML, JSON, JUNIT
    suppressionPath: ${{ parameters.suppressionPath }}
    reportsDirectory: ${{ parameters.outputDirectory }}
    reportFilename: dependency-check-report
    additionalArguments: '--nvdApiKey $(OWASPNVDAPIKey) --nvdApiDelay 16000'
    warnOnCVSSViolation: false
    continueOnError: false

Expected behavior
It is suppose to run without any issue

Additional context
Please note we are waiting for 50mins to complete this job however it is failing

@damu9618 damu9618 added the bug label Jul 1, 2024
@mprins
Copy link
Contributor

mprins commented Jul 1, 2024

@damu9618 This is not a bug in the software, but a duplicate of #6758
problems with the data feeds provided by https://nvd.nist.gov/vuln/data-feeds ,an external resource provided by the (ultimately) US government

@damu9618
Copy link
Author

damu9618 commented Jul 1, 2024

@mprins could you please help us, If you have any work around to resolve this issue?

@jeremylong
Copy link
Owner

if you look at your log - it appears that it was almost done updating but the job was cancelled? Possibly a timeout on your CI?

the error messages like [ERROR] Updating CVE: CVE-2022-3474 are left over debug code that has been removed.

@jeremylong
Copy link
Owner

Also see #6758

@damu9618
Copy link
Author

damu9618 commented Jul 2, 2024

@jeremylong I have tested my pipeline with 30minutes and 50 minutes on both cases I have the same issue

@jeremylong
Copy link
Owner

see #6758

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants