Skip to content

Commit

Permalink
fix: resync NVD information
Browse files Browse the repository at this point in the history
At present, there's an issue in the sync script where the lastModEndDate
is recorded using the current time from the host executing the script.
This is incorrect and could result in missing CVE or Match String data.

Suppose the sync.py script requests modified data between date1 and
date2, with date2 being the current time on the host executing the
script. The NVD might update CVEs and label them as updated at a time
slightly before date2 due to clock discrepancies. When the sync.py
script runs again, it requests data modified between date2 and date3,
potentially missing anything marked as updated just before date2.

The NVD response includes a timestamp from the NVD server indicating
when the data was generated, and this should be used as the
lastModEndDate. As mentioned in [1], "LastModStartDate equals the time
of the last CVE or CPE received."

Re-synchronize the NVD data to ensure all records are complete and current.
Additionally, modify the sync.py script to properly manage the
lastModEndDate information.

Note: There was a change to a lot of CVEs because of the Authorized
Data Publisher (ADP) support was added and sync.py most probably
missed this. From NVD Communication page [2]:

    CVE records within the NVD dataset will contain more information
    (Reference(s), CWE, and CVSS) from additional sources. This new
    information will be displayed on the website and in the API responses,
    attributed to the organization who contributed the information. More
    information regarding ADPs can be reviewed at
    https://www.cve.org/ProgramOrganization/ADPs.

    Downstream data consumers will notice a large shift in the volume of CVE
    Record modifications as part of this change. Going forward,
    organizations should expect CVE records to update at a higher frequency.

[1] https://nvd.nist.gov/developers/start-here
[2] https://www.nist.gov/itl/nvd

Signed-off-by: Frantisek Hrbata <[email protected]>
  • Loading branch information
fhrbata committed Dec 16, 2024
1 parent f6badd0 commit b99e292

Sorry, this diff is taking too long to generate.

It may be too large to display on GitHub.

0 comments on commit b99e292

Please sign in to comment.