Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
At present, there's an issue in the sync script where the lastModEndDate is recorded using the current time from the host executing the script. This is incorrect and could result in missing CVE or Match String data. Suppose the sync.py script requests modified data between date1 and date2, with date2 being the current time on the host executing the script. The NVD might update CVEs and label them as updated at a time slightly before date2 due to clock discrepancies. When the sync.py script runs again, it requests data modified between date2 and date3, potentially missing anything marked as updated just before date2. The NVD response includes a timestamp from the NVD server indicating when the data was generated, and this should be used as the lastModEndDate. As mentioned in [1], "LastModStartDate equals the time of the last CVE or CPE received." Re-synchronize the NVD data to ensure all records are complete and current. Additionally, modify the sync.py script to properly manage the lastModEndDate information. Note: There was a change to a lot of CVEs because of the Authorized Data Publisher (ADP) support was added and sync.py most probably missed this. From NVD Communication page [2]: CVE records within the NVD dataset will contain more information (Reference(s), CWE, and CVSS) from additional sources. This new information will be displayed on the website and in the API responses, attributed to the organization who contributed the information. More information regarding ADPs can be reviewed at https://www.cve.org/ProgramOrganization/ADPs. Downstream data consumers will notice a large shift in the volume of CVE Record modifications as part of this change. Going forward, organizations should expect CVE records to update at a higher frequency. [1] https://nvd.nist.gov/developers/start-here [2] https://www.nist.gov/itl/nvd Signed-off-by: Frantisek Hrbata <[email protected]>
- Loading branch information