Hi Dependency Check team,
we are using your tool quite accessivly to track our software products vulnerabilities.
It all runs fine but on our central integration server we are not able to fetch the json list from cisa.gov. For some reason our server IP is blocked or banned:
curl -v https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
* Trying 2a02:26f0:6c00:195::447a:443...
* TCP_NODELAY set
* Connected to www.cisa.gov (2a02:26f0:6c00:195::447a) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/certs/ca-certificates.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-ECDSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* Server certificate:
* subject: C=US; ST=District of Columbia; L=Washington; O=Department of Homeland Security; CN=www3.dhs.gov
* start date: Dec 16 00:00:00 2022 GMT
* expire date: Sep 20 23:59:59 2023 GMT
* subjectAltName: host "www.cisa.gov" matched cert's "www.cisa.gov"
* issuer: C=US; O=DigiCert Inc; CN=DigiCert TLS RSA SHA256 2020 CA1
* SSL certificate verify ok.
> GET /sites/default/files/feeds/known_exploited_vulnerabilities.json HTTP/1.1
> Host: www.cisa.gov
> User-Agent: curl/7.68.0
> Accept: */*
>
* Mark bundle as not supporting multiuse
< HTTP/1.1 403 Forbidden
< Server: AkamaiGHost
< Mime-Version: 1.0
< Content-Type: text/html
< Content-Length: 350
< X-Reference-Error: 18.2dbb1002.1683700406.cefb84
< Cache-Control: max-age=0
< Expires: Wed, 10 May 2023 06:33:26 GMT
< Date: Wed, 10 May 2023 06:33:26 GMT
< Connection: close
< Strict-Transport-Security: max-age=31536000 ; includeSubDomains
<
<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>
You don't have permission to access "http://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" on this server.<P>
Reference #18.2dbb1002.1683700406.cefb84
</BODY>
</HTML>
* Closing connection 0
* TLSv1.2 (OUT), TLS alert, close notify (256):
Currently dependency-check is failing because of that.
It would be of great help to skip non-fetchable sources, by an explicit configuration property, and continue with what was fetchable.
Kind regards,
Roman
Hi Dependency Check team,
we are using your tool quite accessivly to track our software products vulnerabilities.
It all runs fine but on our central integration server we are not able to fetch the json list from cisa.gov. For some reason our server IP is blocked or banned:
Currently dependency-check is failing because of that.
It would be of great help to skip non-fetchable sources, by an explicit configuration property, and continue with what was fetchable.
Kind regards,
Roman