Upgrade to v9.0.0: what to use as proxy-cache URL?

[lathspell]

We have a proxy/cache server that mirrors https://nvd.nist.gov/feeds/json/cve/1.1/ and that we access using:

cve.urlModified = "https://nvd.foo.com/feeds/json/cve/1.1/nvdcve-1.1-modified.json.gz"
cve.urlBase = "https://nvd.foo.com/feeds/json/cve/1.1/nvdcve-1.1-%d.json.gz"

If I understand correctly this approach will no longer work as NIST is switching from files to an HTTP API.

So we would have to configure a valid API key and then maybe use a standard Gradle proxy to reach nist.gov from a network which cannot access the Internet directly?

[jeremylong]

You would need to create a new cache using https://github.com/jeremylong/Open-Vulnerability-Project/tree/main/vulnz#caching-the-nvd-cve-data

With 9.0.0 we are using the 2.0 JSON schema data that the NVD API provides. The new property would be:

nvd. datafeedUrl = "https://internal.server/cache/nvdcve-{0}.json.gz"

[lathspell]

Thanks for the quick reply, we'll try!

[EugenMayer]

@jeremylong sorry to necro the issue, but i'am not sure i understood it.

We are using

urlModified = "https://our-server.tld/nvdcve-1.1-modified.json.gz"
urlBase = "https://our-server.tld/nvdcve-1.1-%d.json.gz"

right now.

Since we currently base our server on https://github.com/EugenMayer/nist-data-mirror i assume we cannot just switch to

nvd {
  datafeedUrl = "https://our-server.tld/nvdcve-{0}.json.gz"
}

But we rather have to switch to https://github.com/jeremylong/Open-Vulnerability-Project/tree/main/vulnz to match the new cache format?

Is there any dockerized version of it in general? I would love to

• use or create a dockerized version of it
• bundle it in a helm chart like with https://github.com/EugenMayer/helm-charts/tree/main/charts/nist-data-mirror

Am i right to assume that there is yet no dockerized version of vulnz?

[jeremylong]

There is not yet a dockerized version of the vulnz tool to keep an updated NVD. One of the challenges will be the API KEY requirements - or you go with a really large delay? Once the first data load is done it shouldn't matter, but that first load is going to be more difficult.

[EugenMayer]

I cannot see why an API key makes the dockerization any less parctical, just an ENV var that is passed into the cotainer, which is used when it is present.

IMHO Seems like the move the new API seems a little rough at the moment, forcing people into an ecosystem that is not yet on par with the old. I assume we should have supported both api formats in DependencyCheck for the time being.

That said, is there interesting in joining efforts in creating the dockerization

[jeremylong]

Initial PR on dockerization is here: jeremylong/open-vulnerability-cli#87

I haven't had time to look into it yet as I've been dealing with other issues.