How to report

If you are using Apache software and would like to report the fact that there are advisories for dependencies, please see https://security.apache.org/report-dependency/.

Detecting advisories for dependencies

For Java (Maven/Gradle) projects, the OWASP DependencyCheck plugin can be a useful tool to discover advisories in dependencies.

If you publish a Software Bill Of Materials (SBOM) for your artifacts, there are various tools that can detect advisories in dependencies based on that. For more information about SBOMs see SBOM Software Bill of Materials

If you're using GitHub, and it is well-supported for your ecosystem, the Dependency Submission and Dependabot security updates features may work as well.

Publishing machine-readable analysis results

Various scanning tools exist to flag advisories in dependencies, which can be run by us, but also by users of our software. To improve the accuracy of such tools, it would be great if we could share the analysis of whether an advisory in a dependency affects our project in a machine-readable way. VEX (and to some extent VDR) file formats are meant for this. The ecosystem around these tools is still very much in development, if you want to experiment with these feel free to email security@apache.org. For example, the Solr project publishes their analysis results as VEX.

Consuming VEX

VEX documents can be consumed by our DependencyTrack instance. You can read more about this on the page about SBOM Software Bill of Materials.

Some security scanners, such as https://github.com/aquasecurity/trivy/ and https://github.com/intel/cve-bin-tool, are starting to support VEX as well.