LAB: Jenkins CI with Quality Assurance - Part 1

Shadab · March 7, 2025, 10:04pm

[INFO] NVD API has 284,508 records in this update
[INFO] Downloaded 10,000/284,508 (4%)
[INFO] Downloaded 20,000/284,508 (7%)
[INFO] Downloaded 30,000/284,508 (11%)
[INFO] Downloaded 40,000/284,508 (14%)
[INFO] Downloaded 50,000/284,508 (18%)
[INFO] Downloaded 60,000/284,508 (21%)
[INFO] Downloaded 70,000/284,508 (25%)
[INFO] Downloaded 80,000/284,508 (28%)
[INFO] Downloaded 90,000/284,508 (32%)
[INFO] Downloaded 100,000/284,508 (35%)
[INFO] Downloaded 110,000/284,508 (39%)
[INFO] Downloaded 120,000/284,508 (42%)
[INFO] Downloaded 130,000/284,508 (46%)
[INFO] Downloaded 140,000/284,508 (49%)
[INFO] Downloaded 150,000/284,508 (53%)
[INFO] Downloaded 160,000/284,508 (56%)
[INFO] Downloaded 170,000/284,508 (60%)
[INFO] Downloaded 180,000/284,508 (63%)
[INFO] Downloaded 190,000/284,508 (67%)
[INFO] Downloaded 200,000/284,508 (70%)
[INFO] Downloaded 210,000/284,508 (74%)
[INFO] Downloaded 220,000/284,508 (77%)
[INFO] Downloaded 230,000/284,508 (81%)
[INFO] Downloaded 240,000/284,508 (84%)
[ERROR] Failed to process CVE-2024-1719
java.lang.NullPointerException: null
at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:273)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:179)
at java.base/java.util.ArrayList$ArrayListSpliterator.tryAdvance(ArrayList.java:1602)
at java.base/java.util.stream.ReferencePipeline$7$1.accept(ReferencePipeline.java:280)
at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
at java.base/java.util.ArrayList$ArrayListSpliterator.tryAdvance(ArrayList.java:1602)
at java.base/java.util.stream.ReferencePipeline.forEachWithCancel(ReferencePipeline.java:129)
at java.base/java.util.stream.AbstractPipeline.copyIntoWithCancel(AbstractPipeline.java:527)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:513)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
at java.base/java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:230)
at java.base/java.util.stream.MatchOps$MatchOp.evaluateSequential(MatchOps.java:196)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.anyMatch(ReferencePipeline.java:632)
at org.owasp.dependencycheck.data.nvdcve.CveItemOperator.testCveCpeStartWithFilter(CveItemOperator.java:229)
at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(CveDB.java:1096)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.updateCveDb(NvdApiProcessor.java:119)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call(NvdApiProcessor.java:96)
at org.owasp.dependencycheck.data.update.nvd.api.NvdApiProcessor.call(NvdApiProcessor.java:40)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
at java.base/java.lang.Thread.run(Thread.java:840)
[INFO] Downloaded 250,000/284,508 (88%)
[INFO] Downloaded 260,000/284,508 (91%)
[INFO] Downloaded 270,000/284,508 (95%)
[INFO] Downloaded 280,000/284,508 (98%)
[ERROR] Error updating the NVD Data
org.owasp.dependencycheck.data.update.exception.UpdateException: Error updating the NVD Data
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:397)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.update(NvdApiDataSource.java:117)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:906)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:711)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:637)
at org.owasp.dependencycheck.App.runScan(App.java:266)
at org.owasp.dependencycheck.App.run(App.java:198)
at org.owasp.dependencycheck.App.main(App.java:90)
Caused by: io.github.jeremylong.openvulnerability.client.nvd.NvdApiException: Failed to parse NVD data
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next(NvdCveClient.java:363)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient.next(NvdCveClient.java:331)
at org.owasp.dependencycheck.data.update.NvdApiDataSource.processApi(NvdApiDataSource.java:353)
… 7 common frames omitted
Caused by: com.fasterxml.jackson.databind.exc.ValueInstantiationException: Cannot construct instance of `io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ModifiedCiaType`, problem: SAFETY
at [Source: REDACTED (`StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION` disabled); line: 1, column: 3685850] (through reference chain: io.github.jeremylong.openvulnerability.client.nvd.CveApiJson20[“vulnerabilities”]->java.util.ArrayList[1471]->io.github.jeremylong.openvulnerability.client.nvd.DefCveItem[“cve”]->io.github.jeremylong.openvulnerability.client.nvd.CveItem[“metrics”]->io.github.jeremylong.openvulnerability.client.nvd.Metrics[“cvssMetricV40”]->java.util.ArrayList[0]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4[“cvssData”]->io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data[“modifiedSubIntegrityImpact”])
at com.fasterxml.jackson.databind.exc.ValueInstantiationException.from(ValueInstantiationException.java:47)
at com.fasterxml.jackson.databind.DeserializationContext.instantiationException(DeserializationContext.java:2015)
at com.fasterxml.jackson.databind.DeserializationContext.handleInstantiationProblem(DeserializationContext.java:1426)
at com.fasterxml.jackson.databind.deser.std.FactoryBasedEnumDeserializer.deserialize(FactoryBasedEnumDeserializer.java:205)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray(CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer._deserializeFromArray(CollectionDeserializer.java:361)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:246)
at com.fasterxml.jackson.databind.deser.std.CollectionDeserializer.deserialize(CollectionDeserializer.java:30)
at com.fasterxml.jackson.databind.deser.impl.FieldProperty.deserializeAndSet(FieldProperty.java:138)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.vanillaDeserialize(BeanDeserializer.java:310)
at com.fasterxml.jackson.databind.deser.BeanDeserializer.deserialize(BeanDeserializer.java:177)
at com.fasterxml.jackson.databind.deser.DefaultDeserializationContext.readRootValue(DefaultDeserializationContext.java:342)
at com.fasterxml.jackson.databind.ObjectMapper._readMapAndClose(ObjectMapper.java:4917)
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3860)
at com.fasterxml.jackson.databind.ObjectMapper.readValue(ObjectMapper.java:3828)
at io.github.jeremylong.openvulnerability.client.nvd.NvdCveClient._next(NvdCveClient.java:358)
… 9 common frames omitted
Caused by: java.lang.IllegalArgumentException: SAFETY
at io.github.jeremylong.openvulnerability.client.nvd.CvssV4Data$ModifiedCiaType.fromValue(CvssV4Data.java:1224)
at jdk.internal.reflect.GeneratedMethodAccessor158.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:569)
at com.fasterxml.jackson.databind.introspect.AnnotatedMethod.callOnWith(AnnotatedMethod.java:118)
at com.fasterxml.jackson.databind.deser.std.FactoryBasedEnumDeserializer.deserialize(FactoryBasedEnumDeserializer.java:194)
… 38 common frames omitted
[INFO] Updating CISA Known Exploited Vulnerability list: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
[INFO] Begin database defrag
[INFO] End database defrag (5307 ms)
[WARN] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.
[ERROR] Unable to continue dependency-check analysis.
[ERROR] One or more fatal errors occurred
[ERROR] Error updating the NVD Data
[ERROR] No documents exist
ERROR: Mark build as failed because of exit code 13
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
Finished: FAILURE

why i am getting this error i try 4-5 times but same error occurs, please give me the reason of this error and provide steps to complete my lab

rob_kodekloud · March 7, 2025, 10:06pm

What step of the lab were you doing when you get this?

Shadab · March 7, 2025, 10:16pm

LAB: Jenkins CI with Quality Assurance - Part 1 and Question number 9
at the time of build the job in jenkins and the step is OWASP Dependency Check

rob_kodekloud · March 7, 2025, 11:45pm

OK, I see a similar error in Step 9. I’ve reported this to our lab engineers.

Shadab · March 8, 2025, 10:24am

This problem is not solved yet, please solve this issue ASAP, and also confirmation me regarding this issue so i complete my lab.

rob_kodekloud · March 9, 2025, 1:43am

An engineer is assigned to looking at this, but it can take a few days or more before they actually can do anything with it. So check back mid-week after he’s had the chance to do that.

Shadab · March 12, 2025, 6:35pm

The issue is not resolve yet, why?

rob_kodekloud · March 12, 2025, 7:31pm

It’s not trivial to resolve, and depends on when the engineer is available and for how long.

rob_kodekloud · April 4, 2025, 8:36pm

After a fair bit of futzing about, the engineer has a combination of jenkins version and OWASP version that works, at least for now. If you’re still willing, please try this again and see if it works for you.