DependencyCheck: Version 8.0.0. KnownExploitedDataSource proxy HTTP 403

KnownExploitedDataSource Line: 78

https://github.com/jeremylong/DependencyCheck/blob/f3d806de22002d932fe12a706f4b9fa91ed3322d/core/src/main/java/org/owasp/dependencycheck/data/update/KnownExploitedDataSource.java

                //TODO - add all the proxy config, likely use the same as configured for NVD
                final HttpResourceConnection conn = new HttpResourceConnection(settings);

In class HostedSuppressionsDataSource i do not see such a commonet:

https://github.com/jeremylong/DependencyCheck/blob/f3d806de22002d932fe12a706f4b9fa91ed3322d/core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java

Logs:

[ERROR] Failed to execute goal org.owasp:dependency-check-maven:8.0.0:check (default-cli) on project iaml: Fatal exception(s) analyzing aaaaaaaaaa: One or more exceptions occurred during analysis:
[ERROR] 	UpdateException: org.owasp.dependencycheck.utils.DownloadFailedException: Error downloading file https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; unable to connect.
[ERROR] 		caused by DownloadFailedException: Error downloading file https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; unable to connect.
[ERROR] 		caused by IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 403 Forbidden"
[ERROR] 	NoDataException: No documents exist
[ERROR] -> [Help 1]
[ERROR]

About this issue

  • Original URL
  • State: open
  • Created a year ago
  • Reactions: 6
  • Comments: 23 (3 by maintainers)

Commits related to this issue

Most upvoted comments

I’m also getting a 403 from a runner on the Hetzner network. I can’t find anything about a ban list, though.

+2
sblack4 on Feb 17, 2023

@lukasT You can simply check by a curl -v https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json That runs on most systems, but on Hetzner. That’s part of my question. It seems, there es a ban on the hetzner networks.

On Hetzer, I get an 403, 200 and lots of data anywhere else.

Experiencing the same problem… gitlab-runner on Hetzner, scan is failing because not able to download from cisa.gov. Downgraded to maven-plugin version 7.4.4.

+2
thomseno on Jan 30, 2023

The known exploited vulnerability catalog does not add any new vulnerabilities… but any vulnerabilities in the catalog likely need to be patched ASAP as there are known attacks happening using the CVE.

On Thu, Jun 29, 2023, 2:52 PM msaubier @.***> wrote:

My team has been running into this issue intermittently this week…sometimes it works, sometimes it doesn’t. Is there a drawback to disabling the CISA Known Exploited Vulnerability analyzer? Would we potentially miss scanning for any CVEs?

— Reply to this email directly, view it on GitHub https://github.com/jeremylong/DependencyCheck/issues/5313#issuecomment-1613635432, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAGSVQQYBZFMDYPOZOMGEA3XNXFGLANCNFSM6AAAAAAT4SQELM . You are receiving this because you were mentioned.Message ID: @.***>

+1
jeremylong on Jun 29, 2023

The site is blocked in GCP europe-west too. Can’t tell if it blocked the whole GCP network but this is already pretty bad on its own. Why are they doing this? Do they want that nobody is using this?

+1
UbiNickUfer on Mar 21, 2023

you can use a mirror or proxy via the plugin config like so:

<knownExploitedUrl>https://your-mirror-or-proxy/repository/cisa-files/sites/default/files/feeds/known_exploited_vulnerabilities.json</knownExploitedUrl>
+1
alan-czajkowski on Mar 17, 2023

The options would be to mirror the catalog or disable the analyzer.

+1
jeremylong on Feb 17, 2023

DevOps team has changed something in the configuration to fix this

My gut feel: they whitelisted the URL or the entire CISA website on your proxy

+1
aikebah on Jan 18, 2023
Read more comments on GitHub
← DependencyCheck: Stack overflow after upgrading to dependency-check 8.0.0
kotlinter-gradle: installKotlinterPrePushHook not working using 2.4.0 →