Generation \/ verification date:<\/strong> 2026-10-03 Safety boundary:<\/strong> The labs intentionally use known-vulnerable dependency versions so students can observe real scanner findings. Do not deploy the vulnerable lab applications, expose them to untrusted input, or reproduce exploit payloads. This guide teaches identification, analysis, prioritization, remediation, reporting, and secure integration – not exploitation.<\/p>\n<\/blockquote>\n\n\n\n Use macOS, Linux, Windows with WSL, or a training VM. Verify:<\/p>\n\n\n\n Recommended classroom baseline:<\/p>\n\n\n\n Request a key from NVD, then expose only the variable name to Maven:<\/p>\n\n\n\n Do not commit this value.<\/p>\n\n\n\n macOS Homebrew:<\/p>\n\n\n\n Official Anchore installer alternative:<\/p>\n\n\n\n The first modules progressively build this safe local project. It contains a vulnerable dependency but the application only logs a fixed string. Do not feed it untrusted input.<\/p>\n\n\n\n Create the project:<\/p>\n\n\n\n If the build succeeds, continue.<\/p>\n\n\n\n Open-source software is software whose source is available under a license that permits specified forms of use, modification, and redistribution. In modern applications, OSS commonly arrives through package managers rather than by copying source code manually.<\/p>\n\n\n\n In this project, Apache Log4j is an OSS dependency resolved from Maven repositories.<\/p>\n\n\n\n SCA starts with inventory. You cannot reason about vulnerabilities, licenses, or maintenance state until you know which third-party components and versions are present.<\/p>\n\n\n\n Identify the Log4j dependency declared in Start in the shared Do not discuss Log4Shell in depth yet. The learning goal is simply: “this application depends on external OSS, with an exact identity and version.”<\/p>\n\n\n\n Maven coordinates give a reproducible identity: group ID + artifact ID + version. The local repository proves where Maven materialized that external component on this workstation.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Verify the exact GAV Choose one additional dependency already present transitively, locate its JAR under You can identify at least one OSS component by exact coordinates, version, local artifact path, upstream metadata, and license metadata.<\/p>\n\n\n\n A third-party dependency is code your project obtains from another project\/vendor. It can be open source or proprietary. Package managers make adding one easy, which is why dependency governance matters.<\/p>\n\n\n\n Every added dependency expands the software you must track for vulnerabilities, licenses, provenance, maintenance, and transitive dependencies.<\/p>\n\n\n\n Add Apache HttpClient as a second direct dependency, confirm its version, build the project, and scan the resulting dependency list.<\/p>\n\n\n\n Continue in The point is not that HttpClient 4.5.13 is the “recommended” version. It is used here to make dependency-tree behavior easy to observe. Later labs teach updates.<\/p>\n\n\n\n A direct dependency is one explicitly requested by the application. Maven will also resolve any dependencies required by that component.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Confirm that Add one harmless library of your choice, run The project builds, the new dependency is visible with its exact version, and you can distinguish the explicit POM entry from files Maven resolved on its behalf.<\/p>\n\n\n\n A direct dependency appears explicitly in your project manifest. A transitive dependency is required by another dependency and is brought in automatically.<\/p>\n\n\n\n For example:<\/p>\n\n\n\n A vulnerability may exist in a library your team never typed into Use Maven’s dependency tree to prove which components are direct and which are transitive.<\/p>\n\n\n\n The shared project must contain both Ask students to predict the tree before running the command. This quickly exposes the common misconception that “if it is not in my POM, it is not my dependency.”<\/p>\n\n\n\n Maven tree indentation encodes dependency relationships. The first level under the project is direct; deeper levels are transitive unless separately declared.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Your exact transitive versions may differ if upstream metadata changes, but the hierarchy should show HttpClient below the application and several dependencies below HttpClient.<\/p>\n\n\n\n Choose one transitive dependency and find which direct dependency introduced it. Then write the path in You can produce a dependency path for at least one transitive component and explain why removing the parent dependency would affect the child.<\/p>\n\n\n\n A dependency tree is the resolved graph produced by a package\/build tool. It shows hierarchy, versions, scopes, and often conflict resolution.<\/p>\n\n\n\n When Dependency-Check flags a component, the dependency tree answers an operational question: “How did this component get into our build?”<\/p>\n\n\n\n Generate full and filtered trees, save them as evidence, and map a Dependency-Check finding back to its dependency path.<\/p>\n\n\n\n Create Keep tree output as evidence before remediation. It becomes extremely useful when demonstrating that an upgrade or exclusion removed a vulnerable transitive dependency.<\/p>\n\n\n\n The tree is build-tool truth about resolution. Dependency-Check report identity is scanner truth about what it analyzed. Comparing both helps detect missing coverage or unexpected components.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Confirm the saved file is non-empty, records exact versions, and distinguishes direct from transitive indentation. Later, the same file becomes part of the before\/after comparison.<\/p>\n\n\n\n Select any component from For a component selected from disk, you can show exactly which direct dependency or application declaration caused it to be present.<\/p>\n\n\n\n Dependency management means controlling which packages and versions enter a build. Activities include adding, removing, updating, centralizing versions, resolving conflicts, and keeping repeatable manifests.<\/p>\n\n\n\n Maven does not provide a universal native lockfile equivalent to Uncontrolled version drift makes findings difficult to reproduce and remediation difficult to prove.<\/p>\n\n\n\n Centralize selected versions in Maven properties, demonstrate an update, demonstrate removal, and verify resolution each time.<\/p>\n\n\n\n Continue with Avoid saying “latest is always safest.” Updating is a change that must be tested. Security remediation should use a vetted fixed version compatible with the application.<\/p>\n\n\n\n Version properties centralize decisions. The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Look for the difference between “update available” and “update approved.” Also verify that removing a direct dependency removes its transitive branch unless another dependency still requires those components.<\/p>\n\n\n\n Pick one dependency, identify an available update, record the current and candidate versions, and list one compatibility test you would run before accepting it.<\/p>\n\n\n\n You can add\/remove\/update a dependency deliberately, confirm the resulting tree, and explain why dependency management is more than blindly selecting the newest version.<\/p>\n\n\n\n A vulnerable dependency is a component\/version associated with one or more publicly disclosed vulnerabilities. Dependency-Check attempts to identify the component (often using evidence mapped to CPEs) and then associates known vulnerabilities.<\/p>\n\n\n\n The practical SCA job is not merely “a CVE exists.” You need the affected component, version, severity, evidence, dependency path, and an actionable remediation path.<\/p>\n\n\n\n Run the first real Dependency-Check scan against the Maven project and generate all supported report formats. Then locate Log4j 2.14.1 and its vulnerabilities.<\/p>\n\n\n\n Create The first data population can be much slower than later runs. For classroom scale this is acceptable; for CI\/enterprise use, teach the NVD-mirror pattern in Module 7.<\/p>\n\n\n\n Dependency-Check does not patch anything. Its job here is detection and reporting. Remediation is a deliberate dependency update followed by a re-scan.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Open the HTML report and verify the scanner analyzed the expected Maven dependencies. For Log4j Core 2.14.1, current vulnerability data should include the well-known Log4Shell family, including CVE-2021-44228. Do not treat the total finding count as a constant; NVD records and analyzer logic can change.<\/p>\n\n\n\n Choose one vulnerable component and create a four-column note: component\/version, CVE, CVSS\/severity, candidate remediation. Do not yet apply the change.<\/p>\n\n\n\n You have a real generated Dependency-Check baseline report and can trace at least one finding to a concrete dependency\/version and remediation candidate.<\/p>\n\n\n\n CVE is a public identifier for a specific disclosed vulnerability, such as CVE IDs let developers, scanners, advisories, ticketing systems, and external intelligence refer to the same vulnerability.<\/p>\n\n\n\n Extract a CVE from the Dependency-Check JSON report, then verify the same CVE using NVD’s API 2.0 and authoritative references.<\/p>\n\n\n\n Topic 6 must have generated Use Log4Shell because it is real, well documented, and expected for the intentionally vulnerable Log4j version. Do not demonstrate exploitation.<\/p>\n\n\n\n Dependency-Check consumes vulnerability data and produces a useful local association. NVD remains an authoritative vulnerability enrichment source, while upstream vendor advisories are important for exact fix guidance.<\/p>\n\n\n\n The block below is representative output<\/strong>, not a claim that your machine will produce identical lines, ordering, scores, or counts. Vulnerability data changes over time.<\/p>\n\n\n\n Verify the CVE ID matches in both places. Review NVD references and affected-product data; do not infer a fixed version from CVSS alone.<\/p>\n\n\n\n Repeat the process for a second CVE in your generated report. Record one NVD reference and one upstream\/vendor reference where available.<\/p>\n\n\n\n Two scanner CVEs have been independently verified against current authoritative data, with references recorded.<\/p>\n\n\n\n CWE (Common Weakness Enumeration) describes classes of software weaknesses. A CVE is a specific vulnerability instance; a CWE is a category describing the underlying weakness pattern.<\/p>\n\n\n\n CWE helps teams group recurring defect patterns and connect dependency findings to broader secure-development learning.<\/p>\n\n\n\n Locate CWE information associated with CVE-2021-44228 in NVD\/Dependency-Check data and compare CVE vs CWE.<\/p>\n\n\n\n Use the saved NVD object from Topic 7 and the Dependency-Check JSON baseline.<\/p>\n\n\n\n A vulnerability can have more than one weakness mapping, and mappings can change as records are enriched. Teach students to read the current data rather than memorizing one number.<\/p>\n\n\n\n
Primary scanner:<\/strong> OWASP Dependency-Check 13.0.0
Primary build ecosystem:<\/strong> Java + Maven
Capstone:<\/strong> real intentionally vulnerable GitHub training repository
Audience:<\/strong> developers, DevOps engineers, DevSecOps engineers, application security engineers, security champions, trainers<\/p>\n\n\n\n\n
\n\n\n\nLearning Path<\/h2>\n\n\n\n
Fundamentals\n -> Understand Dependencies\n -> Identify Dependencies\n -> Scan Dependencies\n -> Find Vulnerabilities\n -> Interpret CVE \/ CWE \/ CVSS \/ CPE\n -> Analyze Risk with NVD \/ EPSS \/ KEV\n -> Generate Reports\n -> Manage Dependencies\n -> Handle False Positives\n -> Remediate\n -> Integrate into Build and CI\/CD\n -> Apply Security Gates\n -> Generate SBOMs\n -> Add Supply-Chain Context\n -> Work with VEX \/ Provenance \/ Reachability\n -> Complete End-to-End Capstone\n<\/code><\/pre>\n\n\n\n
\n\n\n\nLAB ENVIRONMENT AND VERSION SNAPSHOT<\/h1>\n\n\n\n
Verified Tooling Snapshot – 2026-10-03<\/h2>\n\n\n\n
Tool \/ Integration<\/th> Verified version or current interface used in this guide<\/th> Purpose<\/th><\/tr><\/thead> OWASP Dependency-Check<\/td> 13.0.0<\/strong><\/td> Primary SCA vulnerability scanner<\/td><\/tr> Dependency-Check Maven plugin<\/td> 13.0.0<\/strong><\/td> Build and CI integration<\/td><\/tr> Dependency-Check Gradle plugin<\/td> 13.0.0<\/strong><\/td> Referenced for Gradle users<\/td><\/tr> Dependency-Check Docker image<\/td> owasp\/dependency-check:13.0.0<\/code><\/td>Reproducible CLI path<\/td><\/tr> NVD integration<\/td> NVD API 2.0<\/strong><\/td> Vulnerability source used by Dependency-Check<\/td><\/tr> Maven Versions Plugin<\/td> 2.22.0<\/strong><\/td> Find and apply dependency updates<\/td><\/tr> Syft<\/td> 1.52.0<\/strong><\/td> CycloneDX \/ SPDX SBOM generation and license inventory<\/td><\/tr> Grype<\/td> 0.119.0<\/strong><\/td> Complementary SBOM vulnerability scan<\/td><\/tr> vexctl<\/td> 0.4.4<\/strong><\/td> OpenVEX create \/ validate workflow<\/td><\/tr> CycloneDX<\/td> 1.7<\/strong> current specification referenced<\/td> SBOM \/ VEX-capable standard<\/td><\/tr> SPDX<\/td> 3.0.1<\/strong> current specification; Syft lab emits SPDX JSON supported by Syft<\/td> SBOM \/ software metadata standard<\/td><\/tr> GitHub Actions checkout<\/td> actions\/checkout@v6<\/code><\/td>CI checkout<\/td><\/tr> GitHub setup-java<\/td> actions\/setup-java@v4<\/code><\/td>CI JDK setup<\/td><\/tr> GitHub artifact upload<\/td> actions\/upload-artifact@v4<\/code><\/td>Preserve evidence<\/td><\/tr> GitHub SARIF upload<\/td> github\/codeql-action\/upload-sarif@v4<\/code><\/td>Publish SARIF to code scanning<\/td><\/tr> GitHub artifact attestation<\/td> actions\/attest@v4<\/code><\/td>Provenance \/ attestation lab<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Important current Dependency-Check facts<\/h3>\n\n\n\n
\n
nvdApiKeyEnvironmentVariable<\/code>; do not put the secret directly on a debug-logged command line.<\/li>\n\n\n\n
\n\n\n\nWorkstation Prerequisites<\/h2>\n\n\n\n
git --version\njava -version\nmvn -version\ncurl --version\njq --version\n<\/code><\/pre>\n\n\n\n\n
curl<\/code><\/li>\n\n\n\njq<\/code><\/li>\n\n\n\nvexctl<\/code>\u00a0for VEX lab<\/li>\n<\/ul>\n\n\n\nInstall Dependency-Check CLI – macOS Homebrew option<\/h3>\n\n\n\n
brew update\nbrew install dependency-check\ndependency-check --version\n<\/code><\/pre>\n\n\n\nInstall \/ run Dependency-Check – pinned Docker option<\/h3>\n\n\n\n
mkdir -p \"$HOME\/OWASP-Dependency-Check\/data\" odc-reports\n\ndocker pull owasp\/dependency-check:13.0.0\n\ndocker run --rm --volume \"$(pwd)\":\/src --volume \"$HOME\/OWASP-Dependency-Check\/data\":\/usr\/share\/dependency-check\/data --volume \"$(pwd)\/odc-reports\":\/report owasp\/dependency-check:13.0.0 --version\n<\/code><\/pre>\n\n\n\nOptional NVD API key<\/h3>\n\n\n\n
export NVD_API_KEY='REPLACE_WITH_YOUR_KEY'\n<\/code><\/pre>\n\n\n\nInstall complementary tools<\/h3>\n\n\n\n
brew install syft\nbrew tap anchore\/grype\nbrew install grype\nbrew install vexctl\n\nsyft version\ngrype version\nvexctl version\n<\/code><\/pre>\n\n\n\ncurl -sSfL https:\/\/raw.githubusercontent.com\/anchore\/syft\/main\/install.sh | sudo sh -s -- -b \/usr\/local\/bin\ncurl -sSfL https:\/\/raw.githubusercontent.com\/anchore\/grype\/main\/install.sh | sudo sh -s -- -b \/usr\/local\/bin\n<\/code><\/pre>\n\n\n\n
\n\n\n\nShared Lab Project<\/h2>\n\n\n\n
mkdir -p sca-lab\/src\/main\/java\/lab\ncd sca-lab\n\ncat > pom.xml <<'EOF'\n<project xmlns=\"http:\/\/maven.apache.org\/POM\/4.0.0\"\n xmlns:xsi=\"http:\/\/www.w3.org\/2001\/XMLSchema-instance\"\n xsi:schemaLocation=\"http:\/\/maven.apache.org\/POM\/4.0.0 https:\/\/maven.apache.org\/xsd\/maven-4.0.0.xsd\">\n <modelVersion>4.0.0<\/modelVersion>\n <groupId>com.example<\/groupId>\n <artifactId>sca-lab<\/artifactId>\n <version>1.0.0<\/version>\n\n <properties>\n <maven.compiler.release>11<\/maven.compiler.release>\n <project.build.sourceEncoding>UTF-8<\/project.build.sourceEncoding>\n <log4j.version>2.14.1<\/log4j.version>\n <\/properties>\n\n <dependencies>\n <dependency>\n <groupId>org.apache.logging.log4j<\/groupId>\n <artifactId>log4j-core<\/artifactId>\n <version>${log4j.version}<\/version>\n <\/dependency>\n <\/dependencies>\n\n <build>\n <plugins>\n <plugin>\n <groupId>org.apache.maven.plugins<\/groupId>\n <artifactId>maven-compiler-plugin<\/artifactId>\n <version>3.15.0<\/version>\n <configuration>\n <release>11<\/release>\n <\/configuration>\n <\/plugin>\n <\/plugins>\n <\/build>\n<\/project>\nEOF\n\ncat > src\/main\/java\/lab\/App.java <<'EOF'\npackage lab;\n\nimport org.apache.logging.log4j.LogManager;\nimport org.apache.logging.log4j.Logger;\n\npublic class App {\n private static final Logger LOG = LogManager.getLogger(App.class);\n\n public static void main(String[] args) {\n LOG.info(\"SCA lab started\");\n }\n}\nEOF\n\nmvn -B clean package\n<\/code><\/pre>\n\n\n\n
\n\n\n\nMODULE 1 – SCA FUNDAMENTALS<\/h1>\n\n\n\n
1. Open-Source Software (OSS)<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
pom.xml<\/code>, resolve it with Maven, and locate the downloaded package and metadata on disk.<\/p>\n\n\n\n4. Lab Setup<\/h3>\n\n\n\n
sca-lab<\/code> directory. The initial pom.xml<\/code> already declares log4j-core:2.14.1<\/code>.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
pom.xml<\/code>\u00a0and locate the\u00a0log4j-core<\/code>\u00a0dependency.<\/li>\n\n\n\n\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
grep -n -A4 -B2 'log4j-core' pom.xml\nmvn -B dependency:list\nfind \"$HOME\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-core\/2.14.1\" -maxdepth 1 -type f -print\ngrep -E '<name>|<url>|<license>|<artifactId>|<version>' \"$HOME\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-core\/2.14.1\/log4j-core-2.14.1.pom\" | head -30\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
[INFO] The following files have been resolved:\n[INFO] org.apache.logging.log4j:log4j-core:jar:2.14.1:compile\n...\n~\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-core\/2.14.1\/log4j-core-2.14.1.jar\n~\/.m2\/repository\/org\/apache\/logging\/log4j\/log4j-core\/2.14.1\/log4j-core-2.14.1.pom\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
org.apache.logging.log4j:log4j-core:2.14.1<\/code>, the JAR location, and metadata that points to the upstream project. The local Maven cache is not the package “owner”; it is only your resolved copy.<\/p>\n\n\n\n9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
~\/.m2\/repository<\/code>, and write down its group, artifact, version, upstream URL, and license metadata.<\/p>\n\n\n\n10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
2. Third-Party Dependencies<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
sca-lab<\/code>. We will insert org.apache.httpcomponents:httpclient:4.5.13<\/code> as a direct Maven dependency.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
dependencies<\/code>\u00a0block.<\/li>\n\n\n\ntarget\/dependency<\/code>\u00a0so the CLI can scan a concrete directory.<\/li>\n<\/ol>\n\n\n\n\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
python3 - <<'PY2'\nfrom pathlib import Path\np = Path('pom.xml')\ns = p.read_text()\nneedle = ' <\/dependencies>'\nblock = \"\"\" <dependency>\n <groupId>org.apache.httpcomponents<\/groupId>\n <artifactId>httpclient<\/artifactId>\n <version>4.5.13<\/version>\n <\/dependency>\n\"\"\"\nif 'httpclient<\/artifactId>' not in s:\n s = s.replace(needle, block + needle)\np.write_text(s)\nPY2\n\nmvn -B clean package\nmvn -B dependency:list\nmvn -B dependency:copy-dependencies -DoutputDirectory=target\/dependency\nls -1 target\/dependency | head -30\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
[INFO] BUILD SUCCESS\n...\nhttpclient-4.5.13.jar\nhttpcore-....jar\ncommons-codec-....jar\ncommons-logging-....jar\nlog4j-api-2.14.1.jar\nlog4j-core-2.14.1.jar\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
httpclient-4.5.13.jar<\/code> appears and that additional JARs appeared even though you did not explicitly add them. Those additional JARs set up the next lab on transitive dependencies.<\/p>\n\n\n\n9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
mvn dependency:list<\/code>, then remove the dependency and prove it disappears after mvn clean package<\/code>.<\/p>\n\n\n\n10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
3. Direct vs Transitive Dependencies<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
Application\n -> httpclient (direct)\n -> httpcore (transitive)\n -> commons-logging (transitive)\n -> commons-codec (transitive)\n<\/code><\/pre>\n\n\n\n2. Why It Matters in SCA<\/h3>\n\n\n\n
pom.xml<\/code>. SCA must therefore inspect the resolved dependency graph, not only direct declarations.<\/p>\n\n\n\n3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
log4j-core<\/code> and httpclient<\/code> direct dependencies from Topics 1-2.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
pom.xml<\/code>.<\/li>\n<\/ol>\n\n\n\n\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
mvn -B dependency:tree\nmvn -B dependency:tree -Dincludes=org.apache.httpcomponents:httpclient,org.apache.httpcomponents:httpcore,commons-logging:commons-logging,commons-codec:commons-codec\ngrep -n '<dependency>' pom.xml\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
com.example:sca-lab:jar:1.0.0\n+- org.apache.logging.log4j:log4j-core:jar:2.14.1:compile\n| \\- org.apache.logging.log4j:log4j-api:jar:2.14.1:compile\n\\- org.apache.httpcomponents:httpclient:jar:4.5.13:compile\n +- org.apache.httpcomponents:httpcore:jar:...:compile\n +- commons-logging:commons-logging:jar:...:compile\n \\- commons-codec:commons-codec:jar:...:compile\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
Application -> Direct -> Transitive<\/code> form.<\/p>\n\n\n\n10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
4. Dependency Trees<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
evidence\/<\/code> in the shared project. Topic 6 will generate the first Dependency-Check report; for now save the tree so it can be compared later.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
mkdir -p evidence\nmvn dependency:tree | tee evidence\/dependency-tree-before.txt\nmvn dependency:tree -Dverbose | tee evidence\/dependency-tree-verbose-before.txt\ngrep -E 'log4j|httpclient|httpcore|commons-codec|commons-logging' evidence\/dependency-tree-before.txt\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
[INFO] com.example:sca-lab:jar:1.0.0\n[INFO] +- org.apache.logging.log4j:log4j-core:jar:2.14.1:compile\n[INFO] | \\- org.apache.logging.log4j:log4j-api:jar:2.14.1:compile\n[INFO] \\- org.apache.httpcomponents:httpclient:jar:4.5.13:compile\n...\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
target\/dependency<\/code>, find it in the tree, and record its complete path from the application root.<\/p>\n\n\n\n10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
5. Dependency Management<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
package-lock.json<\/code>. Teams commonly pin explicit versions, use dependencyManagement<\/code>, BOMs, repository controls, and reproducible build practices.<\/p>\n\n\n\n2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
sca-lab<\/code>. Make a backup before changing the POM.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
\ud83d\udca1 Explanation<\/h4>\n\n\n\n
display-dependency-updates<\/code> reports newer releases but does not prove compatibility, maintenance quality, or security by itself.<\/p>\n\n\n\n6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
cp pom.xml evidence\/pom-topic5-before.xml\n\nmvn org.codehaus.mojo:versions-maven-plugin:2.22.0:display-dependency-updates\n\ncp pom.xml \/tmp\/sca-lab-pom.xml\npython3 - <<'PY2'\nfrom pathlib import Path\np=Path('pom.xml')\ns=p.read_text()\nstart=s.index(' <dependency>\n <groupId>org.apache.httpcomponents<\/groupId>')\nend=s.index(' <\/dependency>', start)+len(' <\/dependency>\n')\np.write_text(s[:start]+s[end:])\nPY2\nmvn -B dependency:tree | tee evidence\/tree-without-httpclient.txt\ncp \/tmp\/sca-lab-pom.xml pom.xml\nmvn -B dependency:tree | tee evidence\/tree-restored.txt\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
[INFO] The following dependencies in Dependencies have newer versions:\n...\n[INFO] BUILD SUCCESS\n\n# When removed, the httpclient branch is absent.\n# After restore, it is present again.\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
MODULE 2 – VULNERABILITY FUNDAMENTALS<\/h1>\n\n\n\n
6. Vulnerable Dependencies<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
reports\/before<\/code>. If you have an NVD API key, keep it in NVD_API_KEY<\/code>. The command intentionally sets failBuildOnCVSS=11<\/code> so discovery succeeds even with critical findings; CVSS maximum is 10.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
log4j-core-2.14.1<\/code>.<\/li>\n\n\n\n\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
mkdir -p reports\/before\n\nmvn -B org.owasp:dependency-check-maven:13.0.0:check -Dformat=ALL -Dodc.outputDirectory=reports\/before -DfailBuildOnCVSS=11 -DnvdApiKeyEnvironmentVariable=NVD_API_KEY\n\nfind reports\/before -maxdepth 1 -type f -print | sort\njq '[.dependencies[].vulnerabilities[]?] | length' reports\/before\/dependency-check-report.json\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
[INFO] Analysis Started\n...\n[INFO] Analysis Complete\n[INFO] BUILD SUCCESS\n\nreports\/before\/dependency-check-report.html\nreports\/before\/dependency-check-report.json\nreports\/before\/dependency-check-report.xml\nreports\/before\/dependency-check-report.csv\nreports\/before\/dependency-check-report.sarif\n...\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
7. CVE<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
CVE-2021-44228<\/code>. The CVE identifier is a stable handle; richer analysis comes from records and references maintained by sources such as NVD and the CNA\/vendor.<\/p>\n\n\n\n2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
reports\/before\/dependency-check-report.json<\/code>. curl<\/code> and jq<\/code> are required.<\/p>\n\n\n\n5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n
CVE-2021-44228<\/code>.<\/li>\n\n\n\n\ud83d\udca1 Explanation<\/h4>\n\n\n\n
6. Commands<\/h3>\n\n\n\n
\ud83d\udda5\ufe0f Command<\/h4>\n\n\n\n
grep -n 'CVE-2021-44228' reports\/before\/dependency-check-report.json | head\n\ncurl -s 'https:\/\/services.nvd.nist.gov\/rest\/json\/cves\/2.0?cveId=CVE-2021-44228' | jq '.vulnerabilities[0].cve | {id, published, lastModified, descriptions, metrics, weaknesses, references}' > evidence\/CVE-2021-44228-nvd.json\n\njq '.id, .published, .lastModified' evidence\/CVE-2021-44228-nvd.json\n<\/code><\/pre>\n\n\n\n7. Expected Output<\/h3>\n\n\n\n
\ud83d\udccb Expected Output<\/h4>\n\n\n\n
\"CVE-2021-44228\"\n\"2021-12-10T...\"\n\"...\"\n\n# The full saved object contains descriptions, metrics, weaknesses and references.\n<\/code><\/pre>\n\n\n\n8. What to Look For<\/h3>\n\n\n\n
\ud83d\udd0d Check<\/h4>\n\n\n\n
9. Practical Exercise<\/h3>\n\n\n\n
\ud83e\uddea Exercise<\/h4>\n\n\n\n
10. Expected Result<\/h3>\n\n\n\n
\u2705 Success Criteria<\/h4>\n\n\n\n
11. Key Takeaway<\/h3>\n\n\n\n
\n
8. CWE<\/h2>\n\n\n\n
1. What You Need to Know<\/h3>\n\n\n\n
2. Why It Matters in SCA<\/h3>\n\n\n\n
3. What We Will Do in the Lab<\/h3>\n\n\n\n
4. Lab Setup<\/h3>\n\n\n\n
5. Step-by-Step Lab<\/h3>\n\n\n\n
\ud83d\udc68\u200d\ud83c\udfeb Trainer Note<\/h4>\n\n\n\n
\ud83d\udcbb Student Action<\/h4>\n\n\n\n
\n