fix: resync NVD information #2
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
At present, there's an issue in the sync script where the lastModEndDate
is recorded using the current time from the host executing the script.
This is incorrect and could result in missing CVE or Match String data.
Suppose the sync.py script requests modified data between date1 and
date2, with date2 being the current time on the host executing the
script. The NVD might update CVEs and label them as updated at a time
slightly before date2 due to clock discrepancies. When the sync.py
script runs again, it requests data modified between date2 and date3,
potentially missing anything marked as updated just before date2.
The NVD response includes a timestamp from the NVD server indicating
when the data was generated, and this should be used as the
lastModEndDate. As mentioned in [1], "LastModStartDate equals the time
of the last CVE or CPE received."
Re-synchronize the NVD data to ensure all records are complete and current.
Additionally, modify the sync.py script to properly manage the
lastModEndDate information.
Note: There was a change to a lot of CVEs because of the Authorized
Data Publisher (ADP) support was added and sync.py most probably
missed this. From NVD Communication page [2]:
CVE records within the NVD dataset will contain more information
(Reference(s), CWE, and CVSS) from additional sources. This new
information will be displayed on the website and in the API responses,
attributed to the organization who contributed the information. More
information regarding ADPs can be reviewed at
https://www.cve.org/ProgramOrganization/ADPs.
Downstream data consumers will notice a large shift in the volume of CVE
Record modifications as part of this change. Going forward,
organizations should expect CVE records to update at a higher frequency.
[1] https://nvd.nist.gov/developers/start-here
[2] https://www.nist.gov/itl/nvd
Signed-off-by: Frantisek Hrbata <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
At present, there's an issue in the sync script where the lastModEndDate is recorded using the current time from the host executing the script. This is incorrect and could result in missing CVE or Match String data.
Suppose the sync.py script requests modified data between date1 and date2, with date2 being the current time on the host executing the script. The NVD might update CVEs and label them as updated at a time slightly before date2 due to clock discrepancies. When the sync.py script runs again, it requests data modified between date2 and date3, potentially missing anything marked as updated just before date2.
The NVD response includes a timestamp from the NVD server indicating when the data was generated, and this should be used as the lastModEndDate. As mentioned in [1], "LastModStartDate equals the time of the last CVE or CPE received."
Re-synchronize the NVD data to ensure all records are complete and current. Additionally, modify the sync.py script to properly manage the lastModEndDate information.
Note: There was a change to a lot of CVEs because of the Authorized Data Publisher (ADP) support was added and sync.py most probably missed this. From NVD Communication page [2]:
[1] https://nvd.nist.gov/developers/start-here
[2] https://www.nist.gov/itl/nvd
Description
Related
Testing
Checklist
Before submitting a Pull Request, please ensure the following: