DependencyTrack / DependencyTrack/dependency-track

NistMirrorTask: Impact not inserted

Open
#1,487 2 comments 0 reactions 0 assignees View on GitHub
in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior:
The NistMirroringTask is downlaoding the nvdcve-1.1-modified.json.gz instead of the bigger yearly files.
The file contains a complete dataset to each changed CVE (Example with CVE-2022-0778 attached, which contains also the impact)

Unfortunatly dependencytrack did not read in the impact and shows the Entry as unassigned:

![image](https://user-images.githubusercontent.com/1334939/159444157-6cef492a-92e0-4b17-aef7-403c9a735f0c.png)

### Steps to Reproduce:
Keep Dependencytrack running for a view days

### Expected Behavior:
The CVE has an uodated Impact

### Environment:

- Dependency-Track Version: 4.4.1
- Distribution: [ Docker ]
- BOM Format & Version: 1.2
- Database Server: [ MSSQL]
- Browser: Chrome

### Additional Details:

Impact entry of the above CVE:
```

"impact" : {
"baseMetricV3" : {
"cvssV3" : {
"version" : "3.1",
"vectorString" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"attackVector" : "NETWORK",
"attackComplexity" : "LOW",
"privilegesRequired" : "NONE",
"userInteraction" : "NONE",
"scope" : "UNCHANGED",
"confidentialityImpact" : "NONE",
"integrityImpact" : "NONE",
"availabilityImpact" : "HIGH",
"baseScore" : 7.5,
"baseSeverity" : "HIGH"
},
"exploitabilityScore" : 3.9,
"impactScore" : 3.6
},
"baseMetricV2" : { ....
```

[nvdcve-1.1-modified.json.gz](https://github.com/DependencyTrack/dependency-track/files/8322751/nvdcve-1.1-modified.json.gz)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.