DependencyTrack / DependencyTrack/dependency-track
Dependency-Track NVD API mirroring for Dependency-Check
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
Previously I used the NVD mirroring feature to speed up dependency-check using parameters `-DcveUrlModified=https://my.dependency-track.host/mirror/nvd/nvdcve-1.1-modified.json.gz -DcveUrlBase=https://my.dependency-track.host/mirror/nvd/nvdcve-1.1-%d.json.gz`.
Using dependency-check parameter `nvdDatafeedUrl` results in error `[ERROR] Unable to download the NVD API cache.properties`.
On what endpoint is the NVD API mirroring made available? How can a third party tool use the NVD API mirroring functionality?
### Steps to Reproduce
1. In DT settings set `Enable National Vulnerability Database mirroring`, `Enable mirroring via API`, `Additionally download feeds` and provide an `API key`.
2. Check logs to if `NistMirrorTask` and `NistApiMirrorTask` have run successfully:
```
[NistMirrorTask] NIST mirroring complete
[NistMirrorTask] Time spent (d/l): 3767ms
[NistMirrorTask] Time spent (total): 4411ms
[NistApiMirrorTask] Mirroring of 39 CVEs completed in PT6.87017985S
```
3. Run `mvn org.owasp:dependency-check-maven:9.0.4:aggregate -DnvdDatafeedUrl=https://my.dependency-track.host/mirror/nvd -Dformats=ALL`
4. Results in `[ERROR] Unable to download the NVD API cache.properties
org.owasp.dependencycheck.data.update.exception.UpdateException: Unable to download the NVD API cache.properties
`
### Expected Behavior
I expected to be able to use the mirror functionality in DT in dependency-check just like the formerly downloaded feeds. How should I integrate both OWASP software projects?
What endpoint should be used for NVD mirroring via API for consumption in third party tools (dependency-check)?
I could not find any documentation apart from a tooltip in the settings `Feeds will not be parsed, but made available to other clients at /mirror/nvd`.
### Dependency-Track Version
4.10.0
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
_No response_
### Browser
N/A
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Research direction
Start with the NistMirrorTask and NistApiMirrorTask entry points and the `/mirror/nvd` setting described in the issue. Compare the mirrored API output with the Dependency-Check 9.0.4 command and its expected cache.properties location. Done means the correct third-party consumption endpoint and integration behavior are documented or the reported download failure is resolved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100