Find and Track the hidden vulnerabilities inside your dependencies

on YouTube ↗27m

" summary

Claim: 44% of applications contain critical OSS vulnerabilities. Shows how NVD/CVE and CVSS scores work, then builds a CI pipeline with Jenkins + OWASP DependencyCheck that uploads results to OWASP DependencyTrack. Demo finds a real XXE in Jackson, proves exploit by reading files from the running app, and fixes it by upgrading Jackson to a nonvulnerable 2.7.4+; explains false positives, Maven/NPM support, automated NVD updates, and how to flag and track vulnerabilities across projects.

AI-written summary · about

" chapters (19)

1. 0:00Intro
2. 0:48Risk
3. 2:17Introduction
4. 2:56National Phenology Database
5. 4:02Heartbleed
6. 5:40Common Vulnerability Scoring System
7. 6:42Dependency Check
8. 7:54Demo
9. 8:54Dependency Track
10. 10:44Springwood vulnerability
11. 11:40Jackson vulnerability
12. 14:29Fixing the vulnerability
13. 15:16Checking the base code
14. 15:47Checking the dependencies
15. 17:38Jenkins plugin
16. 18:27Jenkins report
17. 18:45Docker image
18. 19:22API Key
19. 22:45Flag Security Vulnerability

" related talks

• 17mDetect and Track the Vulnerabilities Hiding in Your DependenciesJulien Topçu · BDX I/O 2018
• 20mDetect and track the aliens hiding in your dependenciesJulien Topçu · DevFest Nantes 2018
• 14mDetect and Track the Zergs in Your Dependencies!Julien Topçu · DevFest Toulouse 2018
• 29mFlagship Projects: Dependency-CheckJeremy Long · OWASP 20th Anniversary 2021
• 11mIdentifying Security Vulnerabilities at Scale: Venture Inside a PipelineJustin Young · DevOps World | Jenkins World 2019 San Francisco
• 27mStrangerDanger: Finding Security Vulnerabilities Before They Find YouLiran Tal · ReactiveConf 2019
• 49mOpen-source vulnerability management? Use the source, Luke!Henrik Plate · Conf42 DevSecOps 2022
• 46mSafely through the dependency minefield using OWASP Dependency TrackChristoph Menzel · Øredev 2024