Praveendra Singh created GEODE-5098:
---------------------------------------
Summary: Integrate OWASP Dependency Check for known vulnerabilities
Key: GEODE-5098
URL: https://issues.apache.org/jira/browse/GEODE-5098
Project: Geode
Issue Type: Improvement
Components: build
Reporter: Praveendra Singh
Fix For: 1.7.0
Given the sensitivity of the Geode system, we would like to avoid any
vulnerable dependencies sneaking into the final product. One way to be little
defensive is to leverage OWASP Dependency-Check. There are paid services (e.g.
Veracode) in the market however OWASP tool gives results which are very close
to the commercial services.
h2. OWASP Dependency-Check
Dependency-Check is a utility that identifies project dependencies and checks
if there are any known, publicly disclosed, vulnerabilities.
ref: [https://www.owasp.org/index.php/OWASP_Dependency_Check]
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
