OWASP Dependency-Check

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. You also need a free NVD API key from the NVD developer portal.

Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting size.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network only. No inbound application ports are needed. The VM needs outbound internet access to reach the NVD and build the vulnerability database.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OWASP Dependency-Check by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:owasp-dependency-check-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name owasp-dependency-check \
  --image sac1647283583153:owasp-dependency-check-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

There is no password and no console to log in to, because this product has no credentials. The file /etc/dependency-check/credentials on the VM is an informational note that says so and points to the paths used in the steps below.

Step 4 - Confirm Dependency-Check is installed

Check the scanner version:

dependency-check --version

Dependency-Check Core version 12.2.2

The scanner is on your PATH as dependency-check and runs on the bundled OpenJDK 17 runtime. The helper commands dependency-check-update, dependency-check-scan and dependency-check-selftest are on your PATH too:

ls -1 /usr/local/bin/dependency-check*

/usr/local/bin/dependency-check /usr/local/bin/dependency-check-scan /usr/local/bin/dependency-check-selftest /usr/local/bin/dependency-check-update

Step 5 - Add your free NVD API key

Dependency-Check builds its vulnerability database from the NVD, which requires a free API key. Request one at the NVD developer portal. It arrives by email in a minute or two.

Open the config file in an editor:

sudo nano /etc/dependency-check/dependency-check.conf

Set the NVD_API_KEY line to your key:

NVD_API_KEY="00000000-0000-0000-0000-000000000000"

Your key stays on this VM. It is never baked into the image and never leaves the instance.

Step 6 - Populate the vulnerability database

Run the bundled updater once to download the NVD data into the shared database directory. With an API key, the first run takes several minutes. After that, the daily timer keeps the database current with small incremental updates.

sudo dependency-check-update

[2026-07-19T18:31:44+0000] dependency-check-update: Updating the NVD vulnerability database (this can take several minutes on first run)... [INFO] Checking for updates [INFO] NVD API has 367,610 records in this update [INFO] Download Complete for NVD CVE - Modified (1234 ms) [INFO] Begin database maintenance [INFO] End database maintenance [INFO] Complete

The database lives at /var/lib/dependency-check/data and is shared by every scan on this VM. You run dependency-check-update by hand only once. The daily timer (Step 9) keeps the database current from then on.

Step 7 - Scan a project for vulnerable dependencies

Run dependency-check-scan against any project directory or a single artifact. It writes an HTML report for people and a JSON report for CI, using the local database with no further downloads:

dependency-check-scan /path/to/your/project ./report "My Project"

Scanning /path/to/your/project (project 'My Project') -> ./report (HTML + JSON) [INFO] Analysis Started [INFO] Finished Archive Analyzer (0 seconds) [INFO] Finished File Name Analyzer (0 seconds) [INFO] Finished Jar Analyzer (1 seconds) [INFO] Finished Dependency Merging Analyzer (0 seconds) [INFO] Finished Vulnerable Dependency Analyzer (0 seconds) [INFO] Finished NVD CVE Analyzer (1 seconds) [INFO] Analysis Complete (3 seconds) [INFO] Writing HTML report to: ./report/dependency-check-report.html [INFO] Writing JSON report to: ./report/dependency-check-report.json

Open report/dependency-check-report.html in a browser, or parse report/dependency-check-report.json in your pipeline. Each flagged dependency lists its matched CVEs with severities.

For example, scanning a project that bundles log4j-core 2.14.1 surfaces the well-known Log4Shell vulnerability:

log4j-core-2.14.1.jar CVE-2021-44228 (CRITICAL, CVSSv3 10.0) - Remote code execution via JNDI lookup CVE-2021-45046 (CRITICAL) - Incomplete fix for CVE-2021-44228 CVE-2021-45105 (MEDIUM) - Denial of service

To control formats and analyzers yourself, call the scanner directly:

dependency-check --scan /path/to/project --project "My Project" \
  --out ./report --format HTML --format JSON --format SARIF --noupdate

Step 8 - Prove the scanner works

Run dependency-check-selftest to exercise the scanner end to end against a bundled sample. Before you populate the database, it verifies that the engine loads and points you to the update step. Once the database is populated, it runs a real scan:

sudo dependency-check-selftest

Scanner engine: Dependency-Check Core version 12.2.2 No vulnerability database yet, so a scan cannot run. Populate it first: 1. Get a free NVD API key: https://nvd.nist.gov/developers/request-an-api-key 2. Add it to /etc/dependency-check/dependency-check.conf 3.
sudo dependency-check-update Then re-run:
sudo dependency-check-selftest

Step 9 - Keep the database current (scheduled refresh)

A daily systemd timer runs dependency-check-update for you, so the vulnerability database stays current after the initial populate. The timer is enabled and armed out of the box:

systemctl is-enabled dependency-check-update.timer

enabled

systemctl list-timers dependency-check-update.timer --no-pager

Until you add your API key, the timer does nothing and exits cleanly. Once the key is in place, it refreshes the database with small incremental NVD updates. Inspect a run with journalctl -u dependency-check-update.service.

Configuration

The appliance configuration lives in /etc/dependency-check/dependency-check.conf. Show the active settings:

sudo grep -vE '^\s*#|^\s*$' /etc/dependency-check/dependency-check.conf

NVD_API_KEY="" DC_DATA="/var/lib/dependency-check/data"

• NVD_API_KEY: your free NVD API key from the NVD developer portal. It is empty by default, and the updater does nothing until you set it.
• DC_DATA: the shared system vulnerability-database directory. You can usually leave it as it is.

Dependency-Check's own scan options are passed on the dependency-check command line. They cover report formats, which analyzers run, suppression files and the --failOnCVSS gate for CI. See the Dependency-Check documentation for the full list.

Security

This image is hardened for use as a security tool.

SSH only. Nothing listens on the network except sshd on port 22. Dependency-Check is a batch scanner and binds no port. Verify the listening sockets:

ss -tlnp 2>/dev/null | awk 'NR==1 || /:22 /'

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:*

• No baked credential. The image ships no password of any kind, and the NVD API key setting ships empty. Your key never leaves your VM.
• Patched and self-updating. The OS is fully patched at capture, and unattended security upgrades remain enabled.

Maintenance

• Vulnerability database: populate it with sudo dependency-check-update after adding your key. dependency-check-update.timer then refreshes it daily. Inspect runs with journalctl -u dependency-check-update.service.
• Scanning: use dependency-check-scan <path> <out-dir> <project> for HTML and JSON reports, or call dependency-check directly for full control over formats and analyzers.
• CI gate: add --failOnCVSS <score> to a dependency-check invocation to fail a build when a dependency at or above that CVSS score is found.
• Upgrades: download a newer release from the Dependency-Check releases, verify it against the published checksum, and replace /opt/dependency-check.
• Security patches: unattended-upgrades remains enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch OWASP Dependency-Check on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com