<p>All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.</p>
<p>You can do that with the <code>failBuildOnCVSS</code> config flag. E.g. with severity 8 from <a href="https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html" rel="nofollow noreferrer">docs</a></p>
<pre><code>&lt;project&gt;
    ...
    &lt;build&gt;
        ...
        &lt;plugins&gt;
            ...
            &lt;plugin&gt;
              &lt;groupId&gt;org.owasp&lt;/groupId&gt;
              &lt;artifactId&gt;dependency-check-maven&lt;/artifactId&gt;
              &lt;version&gt;6.2.2&lt;/version&gt;
              &lt;configuration&gt;
                  &lt;failBuildOnCVSS&gt;8&lt;/failBuildOnCVSS&gt;
              &lt;/configuration&gt;
              &lt;executions&gt;
                  &lt;execution&gt;
                      &lt;goals&gt;
                          &lt;goal&gt;check&lt;/goal&gt;
                      &lt;/goals&gt;
                  &lt;/execution&gt;
              &lt;/executions&gt;
            &lt;/plugin&gt;
            ...
        &lt;/plugins&gt;
        ...
    &lt;/build&gt;
    ...
&lt;/project&gt;
</code></pre>
<p>By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.</p>

CC BY-SA 4.0
2021-08-22T16:00:28.430Z
2021-08-22T16:23:31.893Z
2021-08-22T16:23:31.893Z
Chris
<p>I am currently using dependency checker to scan my applications via gitlab</p>
<p>This is how my pipeline looks like.</p>
<pre><code>dependency_scanning:
  stage: security_scan
  script:
    # Run dependency check on all modules
    - mvn dependency-check:aggregate -B &quot;-DdbUser=$NVD_DB_USER&quot; &quot;-DdbPassword=$NVD_DB_PASSWORD&quot; &quot;-DconnectionString=$NVD_DB_CONSTRING&quot;
  artifacts:
    paths:
      - ./target/dependency-check-report.html
  only:
    - master
</code></pre>
<p>And this is my output.</p>
<pre><code>Executing &quot;step_script&quot; stage of the job script
00:32
$ mvn dependency-check:aggregate -B &quot;-DdbUser=$NVD_DB_USER&quot; &quot;-DdbPassword=$NVD_DB_PASSWORD&quot; &quot;-DconnectionString=$NVD_DB_CONSTRING&quot;
3304 [INFO] Scanning for projects...
4813 [INFO] 
4813 [INFO] --------------------&lt; com.example:pipeline-tester &gt;---------------------
4814 [INFO] Building demo 0.0.1-SNAPSHOT
4814 [INFO] --------------------------------[ jar ]---------------------------------
6018 [INFO] 
6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
12434 [INFO] Checking for updates
12494 [INFO] Skipping NVD check since last check was within 4 hours.
12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
12499 [INFO] Check for updates complete (64 ms)
12577 [INFO] 
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
   About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
   False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
 Sponsor: https://github.com/sponsors/jeremylong
12579 [INFO] Analysis Started
14108 [INFO] Finished Archive Analyzer (1 seconds)
14113 [INFO] Finished File Name Analyzer (0 seconds)
16312 [INFO] Finished Jar Analyzer (2 seconds)
16401 [INFO] Finished Dependency Merging Analyzer (0 seconds)
16405 [INFO] Finished Version Filter Analyzer (0 seconds)
16811 [INFO] Finished Hint Analyzer (0 seconds)
22504 [INFO] Created CPE Index (5 seconds)
28005 [INFO] Finished CPE Analyzer (11 seconds)
28010 [INFO] Finished False Positive Analyzer (0 seconds)
28609 [INFO] Finished NVD CVE Analyzer (0 seconds)
29109 [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
29522 [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
29606 [INFO] Finished Dependency Bundling Analyzer (0 seconds)
29908 [INFO] Analysis Complete (17 seconds)
30206 [INFO] Writing report to: /builds/cdit/pipeline-tester/target/dependency-check-report.html
31205 [WARNING] 
One or more dependencies were identified with known vulnerabilities in demo:
tomcat-embed-core-9.0.46.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46, cpe:2.3:a:apache:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_software_foundation:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.46:*:*:*:*:*:*:*) : CVE-2021-33037
See the dependency-check report for more details.
31513 [INFO] ------------------------------------------------------------------------
31514 [INFO] BUILD SUCCESS
31514 [INFO] ------------------------------------------------------------------------
31514 [INFO] Total time:  28.305 s
31514 [INFO] Finished at: 2021-08-12T07:20:28Z
31514 [INFO] ------------------------------------------------------------------------
Saving cache for successful job
00:01
Creating cache master...
.m2/repository: found 3366 matching files and directories 
Archive is up to date!                             
Created cache
Uploading artifacts for successful job
00:00
Uploading artifacts...
./target/dependency-check-report.html: found 1 matching files and directories 
Uploading artifacts as &quot;archive&quot; to coordinator... ok  id=335682 responseStatus=201 Created token=Bf8rx3gp
Cleaning up file based variables
00:00
Job succeeded
</code></pre>
<p>Is it possible to make my pipeline fail even though it is success, in this case when vulnerabilities are present?</p>

CC BY-SA 4.0
2021-08-20T12:50:36.637Z
A a very general tip, `exit 1` (or any non 0 rc) anywhere in you pipeline should fail it. So you could detect what comes back from your previous command and exit with error when need be. Meanwhile, I'm not very familiar with the maven dependency-check plugin, but I'm quite sure you have a configuration option or a specific way to call it that will let it exit with an error code itself if a vulnerability is found.
Zeitounator
<gitlab><cicd><pipeline>
How do I fail a gitlab pipeline job?
shadow
# How do I fail a gitlab pipeline job?

(Asked by: username_0 on 2021-08-12)

I am currently using dependency checker to scan my applications via gitlab
This is how my pipeline looks like.
dependency_scanning:
  stage: security_scan
  script:
    # Run dependency check on all modules
    - mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
  artifacts:
    paths:
      - ./target/dependency-check-report.html
  only:
    - master

And this is my output.
Executing "step_script" stage of the job script
00:32
$ mvn dependency-check:aggregate -B "-DdbUser=$NVD_DB_USER" "-DdbPassword=$NVD_DB_PASSWORD" "-DconnectionString=$NVD_DB_CONSTRING"
3304 [INFO] Scanning for projects...
4813 [INFO] 
4813 [INFO] --------------------< com.example:pipeline-tester >---------------------
4814 [INFO] Building demo 0.0.1-SNAPSHOT
4814 [INFO] --------------------------------[ jar ]---------------------------------
6018 [INFO] 
6019 [INFO] --- dependency-check-maven:6.2.2:aggregate (default-cli) @ pipeline-tester ---
12434 [INFO] Checking for updates
12494 [INFO] Skipping NVD check since last check was within 4 hours.
12497 [INFO] Skipping RetireJS update since last update was within 24 hours.
12499 [INFO] Check for updates complete (64 ms)
12577 [INFO] 
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
   About ODC: https://jeremylong.github.io/DependencyCheck/general/internals.html
   False Positives: https://jeremylong.github.io/DependencyCheck/general/suppression.html
 Sponsor: https://github.com/sponsors/jeremylong
12579 [INFO] Analysis Started
14108 [INFO] Finished Archive Analyzer (1 seconds)
14113 [INFO] Finished File Name Analyzer (0 seconds)
16312 [INFO] Finished Jar Analyzer (2 seconds)
16401 [INFO] Finished Dependency Merging Analyzer (0 seconds)
16405 [INFO] Finished Version Filter Analyzer (0 seconds)
16811 [INFO] Finished Hint Analyzer (0 seconds)
22504 [INFO] Created CPE Index (5 seconds)
28005 [INFO] Finished CPE Analyzer (11 seconds)
28010 [INFO] Finished False Positive Analyzer (0 seconds)
28609 [INFO] Finished NVD CVE Analyzer (0 seconds)
29109 [INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
29522 [INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
29606 [INFO] Finished Dependency Bundling Analyzer (0 seconds)
29908 [INFO] Analysis Complete (17 seconds)
30206 [INFO] Writing report to: /builds/cdit/pipeline-tester/target/dependency-check-report.html
31205 [WARNING] 
One or more dependencies were identified with known vulnerabilities in demo:
tomcat-embed-core-9.0.46.jar (pkg:maven/org.apache.tomcat.embed/tomcat-embed-core@9.0.46, cpe:2.3:a:apache:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_software_foundation:tomcat:9.0.46:*:*:*:*:*:*:*, cpe:2.3:a:apache_tomcat:apache_tomcat:9.0.46:*:*:*:*:*:*:*) : CVE-2021-33037
See the dependency-check report for more details.
31513 [INFO] ------------------------------------------------------------------------
31514 [INFO] BUILD SUCCESS
31514 [INFO] ------------------------------------------------------------------------
31514 [INFO] Total time:  28.305 s
31514 [INFO] Finished at: 2021-08-12T07:20:28Z
31514 [INFO] ------------------------------------------------------------------------
Saving cache for successful job
00:01
Creating cache master...
.m2/repository: found 3366 matching files and directories 
Archive is up to date!                             
Created cache
Uploading artifacts for successful job
00:00
Uploading artifacts...
./target/dependency-check-report.html: found 1 matching files and directories 
Uploading artifacts as "archive" to coordinator... ok  id=335682 responseStatus=201 Created token=Bf8rx3gp
Cleaning up file based variables
00:00
Job succeeded

Is it possible to make my pipeline fail even though it is success, in this case when vulnerabilities are present?

**Tags:** gitlab, cicd, pipeline

> **Comments:**
> **username_1**: A a very general tip, `exit 1` (or any non 0 rc) anywhere in you pipeline should fail it. So you could detect what comes back from your previous command and exit with error when need be. Meanwhile, I'm not very familiar with the maven dependency-check plugin, but I'm quite sure you have a configuration option or a specific way to call it that will let it exit with an error code itself if a vulnerability is found.  

---

## 1 answers

### Answer by username_2 on 2021-08-22. Score: 2 | Accepted answer

All you need to do is to configure the mvn dependency plugin to fail on found vulnerabilities.
You can do that with the failBuildOnCVSS config flag. E.g. with severity 8 from docs

    ...
    
        ...
        
            ...
            
              org.owasp
              dependency-check-maven
              6.2.2
              
                  8
              
              
                  
                      
                          check
                      
                  
              
            
            ...
        
        ...
    
    ...


By that the mvn job will fail if vulnerabilities with severity of 8 or higher are found and by that the pipeline will fail too.


---

