OWASP Dependency-Check on Ubuntu 24.04 on Azure User Guide

Overview

OWASP Dependency-Check is the OWASP Foundation's software composition analysis (SCA) tool. It scans your application's third-party dependencies, identifies the libraries actually in use, and reports the publicly disclosed vulnerabilities (CVEs) associated with them by matching against the National Vulnerability Database (NVD). It understands Java, .NET, JavaScript and Node, Python, Ruby, PHP, Go and more, and produces HTML, JSON, XML, CSV, SARIF and JUnit reports for developers and CI pipelines.

The cloudimg image is a ready-to-run SCA host, not just the binary. It ships the pinned scanner with a bundled Java runtime, a config file for your own free NVD API key, a shared system database directory, a helper and daily timer that keep the vulnerability database current, an HTML and JSON scan wrapper, and a built-in self-test. Backed by 24/7 cloudimg support.

What is included:

• OWASP Dependency-Check 12.2.2 (/usr/local/bin/dependency-check), installed from the official release archive and verified against the upstream SHA256 checksum
• A bundled Java runtime (OpenJDK 17 headless)
• A config file at /etc/dependency-check/dependency-check.conf for your free NVD API key
• A shared system CVE-database directory at /var/lib/dependency-check/data
• dependency-check-update + dependency-check-update.timer - a daily refresh of the NVD vulnerability database
• dependency-check-scan - a convenience wrapper that writes HTML and JSON reports in one command
• dependency-check-selftest - a bundled self-test so you can prove the scanner works
• 24/7 cloudimg support

This is a command-line product: no web UI, no admin account and no password. SSH on port 22 is the only open port, and the SSH key you choose at launch is the only way in.

The NVD API key is required. Dependency-Check builds a local copy of the National Vulnerability Database, and the NVD now requires a free API key for that data feed. Building the database at image-build time is heavily rate-limited and would make the image stale on day one, so this image deliberately ships without a populated database. You add your own free key once (Step 5) and populate the database (Step 6); your key never leaves your VM.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet + subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a good starting point. NSG inbound: allow 22/tcp from your management network only - no inbound application ports are needed. Outbound internet access is required to reach the NVD (to build the vulnerability database). A free NVD API key from the NVD developer portal.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OWASP Dependency-Check by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name owasp-dependency-check \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

There is no password and no console to log in to - this product has no credentials. /etc/dependency-check/credentials on the VM is an informational note that says exactly that and points at the paths below.

Step 4 - Confirm Dependency-Check is installed

dependency-check --version

Dependency-Check Core version 12.2.2

The scanner is on your PATH as dependency-check, backed by the bundled OpenJDK 17 runtime. The helper commands dependency-check-update, dependency-check-scan and dependency-check-selftest are also on your PATH:

ls -1 /usr/local/bin/dependency-check*

/usr/local/bin/dependency-check
/usr/local/bin/dependency-check-scan
/usr/local/bin/dependency-check-selftest
/usr/local/bin/dependency-check-update

Step 5 - Add your free NVD API key

Dependency-Check builds its vulnerability database from the NVD, which requires a free API key. Request one at the NVD developer portal (you receive it by email in a minute or two), then paste it into the config file:

sudo nano /etc/dependency-check/dependency-check.conf

Set the NVD_API_KEY line to your key:

NVD_API_KEY="00000000-0000-0000-0000-000000000000"

Your key stays on this VM - it is never baked into the image and never leaves the instance.

Step 6 - Populate the vulnerability database

Run the bundled updater once to download the NVD data into the shared database directory. With an API key this takes several minutes on the first run; afterwards the daily timer keeps it current with small incremental updates.

sudo dependency-check-update

[2026-07-19T18:31:44+0000] dependency-check-update: Updating the NVD vulnerability database (this can take several minutes on first run)...
[INFO] Checking for updates
[INFO] NVD API has 367,610 records in this update
[INFO] Download Complete for NVD CVE - Modified  (1234 ms)
[INFO] Begin database maintenance
[INFO] End database maintenance
[INFO] Complete

The database lives at /var/lib/dependency-check/data, shared by every scan on this VM. You only run dependency-check-update by hand once - the daily timer (Step 9) keeps it current from then on.

Step 7 - Scan a project for vulnerable dependencies

Point dependency-check-scan at any project directory (or a single artifact). It writes an HTML report for humans and a JSON report for CI, using the local database with no further downloads:

dependency-check-scan /path/to/your/project ./report "My Project"

Scanning /path/to/your/project (project 'My Project') -> ./report (HTML + JSON)
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (1 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Vulnerable Dependency Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (1 seconds)
[INFO] Analysis Complete (3 seconds)
[INFO] Writing HTML report to: ./report/dependency-check-report.html
[INFO] Writing JSON report to: ./report/dependency-check-report.json

Open report/dependency-check-report.html in a browser, or parse report/dependency-check-report.json in your pipeline. Each flagged dependency lists its matched CVEs with severities. For example, scanning a project that bundles log4j-core 2.14.1 surfaces the well-known Log4Shell vulnerability:

log4j-core-2.14.1.jar
  CVE-2021-44228 (CRITICAL, CVSSv3 10.0) - Remote code execution via JNDI lookup
  CVE-2021-45046 (CRITICAL) - Incomplete fix for CVE-2021-44228
  CVE-2021-45105 (MEDIUM)   - Denial of service

You can also call the scanner directly for full control over formats and analyzers, for example:

dependency-check --scan /path/to/project --project "My Project" \
  --out ./report --format HTML --format JSON --format SARIF --noupdate

Step 8 - Prove the scanner works

dependency-check-selftest runs the scanner end to end against a bundled sample so you can confirm everything is wired up. Before you populate the database it verifies the engine loads and points you at the update step; once the database is populated it runs a real scan:

sudo dependency-check-selftest

Scanner engine: Dependency-Check Core version 12.2.2

No vulnerability database yet, so a scan cannot run. Populate it first:
  1. Get a free NVD API key: https://nvd.nist.gov/developers/request-an-api-key
  2. Add it to /etc/dependency-check/dependency-check.conf
  3. sudo dependency-check-update
Then re-run: sudo dependency-check-selftest

Step 9 - Keep the database current (scheduled refresh)

A daily systemd timer runs dependency-check-update for you, so the vulnerability database stays current after the initial populate. It is enabled and armed out of the box:

systemctl is-enabled dependency-check-update.timer

enabled

systemctl list-timers dependency-check-update.timer --no-pager

The timer no-ops cleanly until you have added your API key, and refreshes with small incremental NVD updates once you have. Inspect a run with journalctl -u dependency-check-update.service.

Configuration

The appliance configuration lives in /etc/dependency-check/dependency-check.conf:

sudo grep -vE '^\s*#|^\s*$' /etc/dependency-check/dependency-check.conf

NVD_API_KEY=""
DC_DATA="/var/lib/dependency-check/data"

• NVD_API_KEY - your free NVD API key (from the NVD developer portal). Empty by default; the updater no-ops until you set it.
• DC_DATA - the shared system vulnerability-database directory (usually leave as-is).

Dependency-Check's own scan options (report formats, which analyzers run, suppression files, the --failOnCVSS gate for CI) are passed on the dependency-check command line. See the Dependency-Check documentation for the full list.

Security

This image is hardened for a security tool:

• SSH only. Nothing listens on the network except sshd on port 22. Dependency-Check is a batch scanner - it binds no port:

ss -tlnp 2>/dev/null | awk 'NR==1 || /:22 /'

State   Recv-Q  Send-Q   Local Address:Port   Peer Address:Port
LISTEN  0       128            0.0.0.0:22          0.0.0.0:*

• No baked credential. The image ships no password of any kind, and the NVD API key config ships empty - your key never leaves your VM.
• Patched and self-updating. The OS is fully patched at capture and unattended security upgrades remain enabled.

Maintenance

• Vulnerability database: populated with sudo dependency-check-update (after adding your key) and refreshed daily by dependency-check-update.timer. Inspect runs with journalctl -u dependency-check-update.service.
• Scanning: dependency-check-scan <path> <out-dir> <project> for HTML + JSON, or call dependency-check directly for full control over formats and analyzers.
• CI gate: add --failOnCVSS <score> to a dependency-check invocation to fail a build when a dependency at or above that CVSS score is found.
• Upgrades: download a newer release from the Dependency-Check releases, verify it against the published checksum, and replace /opt/dependency-check.
• Security patches: unattended-upgrades remains enabled, so the OS continues to receive security updates automatically.

Support

cloudimg provides 24/7 expert support for this image. Contact support@cloudimg.co.uk.