diff options
author | Salvatore Bonaccorso <carnil@debian.org> | 2019-10-19 22:45:37 +0200 |
---|---|---|
committer | Salvatore Bonaccorso <carnil@debian.org> | 2019-10-20 21:17:11 +0200 |
commit | 3f5d7c909f6075fa418215e02349746f6f236f00 (patch) | |
tree | 98317ea4317d495a270abc45a006a9b4a854fa35 | |
parent | aff666e776b5e8ec718f75d932c47bce69c4d3cd (diff) |
update-nvd: Fetch NVD JSON feeds instead of XML feeds
As per October 16, 2019, NVD does not provide anymore the XML data
feeds which the security-tracker uses to fill in long description of a
CVE or determine the external severity.
In update-nvd target switch to fetch the json files from
https://nvd.nist.gov/feeds/json/cve/1.1/$feedname
instead.
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
-rw-r--r-- | Makefile | 8 |
1 files changed, 5 insertions, 3 deletions
@@ -112,14 +112,16 @@ update-lists: # Since October 16, 2015 the XML data feeds are no longer available for # download in an uncompressed format. +# As per October 16, 2019, the XML data feeds were discontinued and NVD +# only provides JSON feeds. Cf. https://bugs.debian.org/942670 update-nvd: mkdir -p data/nvd for x in $$(seq 2002 $$(date +%Y)) ; do \ - name=nvdcve-$$x.xml.gz; \ - wget -q -Odata/nvd/$$name https://nvd.nist.gov/download/$$name || true; \ + name=nvdcve-1.1-$$x.json.gz; \ + wget -q -Odata/nvd/$$name https://nvd.nist.gov/feeds/json/cve/1.1/$$name || true; \ gzip -f -d data/nvd/$$name || true; \ done - bin/update-nvd data/nvd/nvdcve-*.xml + bin/update-nvd data/nvd/nvdcve-*.json # Experimental code to compare the Debian and NVD CVE databases using # CPE values as common key. |