DependencyTrack / DependencyTrack/dependency-track

Dependency-Track NVD API mirroring for Dependency-Check

Open
#3,293 29 comments 8 reactions 0 assignees View on GitHub
defect needs milestone size/M
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Previously I used the NVD mirroring feature to speed up dependency-check using parameters `-DcveUrlModified=https://my.dependency-track.host/mirror/nvd/nvdcve-1.1-modified.json.gz -DcveUrlBase=https://my.dependency-track.host/mirror/nvd/nvdcve-1.1-%d.json.gz`.
Using dependency-check parameter `nvdDatafeedUrl` results in error `[ERROR] Unable to download the NVD API cache.properties`.

On what endpoint is the NVD API mirroring made available? How can a third party tool use the NVD API mirroring functionality?

### Steps to Reproduce

1. In DT settings set `Enable National Vulnerability Database mirroring`, `Enable mirroring via API`, `Additionally download feeds` and provide an `API key`.
2. Check logs to if `NistMirrorTask` and `NistApiMirrorTask` have run successfully:

```
[NistMirrorTask] NIST mirroring complete
[NistMirrorTask] Time spent (d/l): 3767ms
[NistMirrorTask] Time spent (total): 4411ms
[NistApiMirrorTask] Mirroring of 39 CVEs completed in PT6.87017985S
```

3. Run `mvn org.owasp:dependency-check-maven:9.0.4:aggregate -DnvdDatafeedUrl=https://my.dependency-track.host/mirror/nvd -Dformats=ALL`
4. Results in `[ERROR] Unable to download the NVD API cache.properties
org.owasp.dependencycheck.data.update.exception.UpdateException: Unable to download the NVD API cache.properties
`

### Expected Behavior

I expected to be able to use the mirror functionality in DT in dependency-check just like the formerly downloaded feeds. How should I integrate both OWASP software projects?

What endpoint should be used for NVD mirroring via API for consumption in third party tools (dependency-check)?
I could not find any documentation apart from a tooltip in the settings `Feeds will not be parsed, but made available to other clients at /mirror/nvd`.

### Dependency-Track Version

4.10.0

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

_No response_

### Browser

N/A

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Research direction

Start with the NistMirrorTask and NistApiMirrorTask entry points and the `/mirror/nvd` setting described in the issue. Compare the mirrored API output with the Dependency-Check 9.0.4 command and its expected cache.properties location. Done means the correct third-party consumption endpoint and integration behavior are documented or the reported download failure is resolved.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.