Moderne licensed

Use VulnCheck Exploit Intelligence to fix vulnerabilities

Recipe IDio.moderne.vulncheck.FixVulnCheckVulnerabilities

Artifactio.moderne.recipe:rewrite-vulncheck

This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. This recipe by default only upgrades to the latest **patch** version. If a minor or major upgrade is required to reach the fixed version, this can be controlled using the maximumUpgradeDelta option. Vulnerability information comes from VulnCheck Vulnerability Intelligence. The recipe has an option to limit fixes to only those vulnerabilities that have evidence of exploitation at various levels of severity.

Single recipeProprietary

Usage

You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe io.moderne.vulncheck.FixVulnCheckVulnerabilities --recipe-option "apiToken=A_TOKEN_GENERATED_FROM_VULNCHECK"

If the recipe isn’t available locally, install it with:

mod config recipes jar install io.moderne.recipe:rewrite-vulncheck:0.7.6

Options

Name	Type	Description
`apiToken`required	`String`	The API token for the VulnCheck api e.g. `A_TOKEN_GENERATED_FROM_VULNCHECK`
`scope`	`String`	Match dependencies with the specified scope. Default is `compile`. An explanation of what each scope means can be found in the Apache Maven documentation. e.g. `compile`
`overrideTransitive`	`Boolean`	When enabled transitive dependencies with vulnerabilities will have their versions overridden. By default only direct dependencies have their version numbers upgraded. e.g. `false`
`maximumUpgradeDelta`	`UpgradeDelta`	The maximum difference to allow when suggesting a dependency version upgrade. Patch version upgrades are the default and safest option, as patch releases assert full backwards compatibility with no breaking changes. Minor version upgrades can introduce new features but do not _typically_ include breaking changes. Major version upgrades will typically require code changes above and beyond this recipe. e.g. `patch`
`exploitMaturity`	`String`	Fix only those vulnerabilities that have an exploit maturity level equal to or greater than the specified level. e.g. `weaponized`

Data tables

Structured output this recipe can produce.

Maven metadata failuresAttempts to resolve maven metadata that failed.org.openrewrite.maven.table.MavenMetadataFailures
Vulnerability reportA vulnerability report that includes detailed information about the affected artifact and the corresponding CVEs.org.openrewrite.java.dependencies.table.VulnerabilityReport
Vulnerability report with exploit intelligenceA vulnerability report that includes detailed information about the affected artifact and the corresponding CVEs and enriched by VulnCheck exploit data.io.moderne.vulncheck.table.VulnerabilityReportWithExploits
Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats