OWASP Dependency-Check plugin でAndroidアプリのライブラリ脆弱性をチェックする

buildscript {
    repositories {
        mavenCentral()
    }

    dependencies {
        classpath 'org.owasp:dependency-check-gradle:6.5.0.1'
    }
}

apply plugin: 'org.owasp.dependencycheck'

dependencyCheck {
    failBuildOnCVSS = 0
    scanConfigurations = configurations.findAll {
        !it.name.startsWithAny('androidTest', 'test', 'debug') &&
                it.name.contains("DependenciesMetadata") && (
                it.name.startsWithAny("api", "implementation", "runtimeOnly") ||
                          it.name.contains("Api") ||
                        it.name.contains("Implementation") ||
                        it.name.contains("RuntimeOnly")
        )
    }.collect {
        it.name
    }
}

E:\app>gradlew dependencyCheckAnalyze

> Task :app:dependencyCheckAnalyze
Verifying dependencies for project app
Checking for updates and analyzing dependencies for vulnerabilities
Generating report for project app
Found 3 vulnerabilities in project app


One or more dependencies were identified with known vulnerabilities in app:

jsoup-1.13.1.jar (pkg:maven/org.jsoup/jsoup@1.13.1, cpe:2.3:a:jsoup:jsoup:1.13.1:*:*:*:*:*:*:*) : CVE-2021-37714
kotlin-android-extensions-runtime-1.3.72.jar (pkg:maven/org.jetbrains.kotlin/kotlin-android-extensions-runtime@1.3.72, cpe:2.3:a:jetbrains:kotlin:1.3.72:*:*:*:*:*:*:*) : CVE-2020-29582
storage-0.8.0.aar (pkg:maven/com.anggrayudi/storage@0.8.0, cpe:2.3:a:storage_project:storage:0.8.0:*:*:*:*:*:*:*) : CVE-2021-20291


See the dependency-check report for more details.



> Task :app:dependencyCheckAnalyze FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':app:dependencyCheckAnalyze'.
>

  Dependency-Analyze Failure:
  One or more dependencies were identified with vulnerabilities that have a CVSS score greater than '0.0': CVE-2021-37714, CVE-2020-29582, CVE-2021-20291
  See the dependency-check report for more details.



* Try:
Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

* Get more help at https://help.gradle.org

BUILD FAILED in 2m 29s
1 actionable task: 1 executed