diff options
| author | Salvatore Bonaccorso <carnil@debian.org> | 2019-10-19 22:45:37 +0200 |
|---|---|---|
| committer | Salvatore Bonaccorso <carnil@debian.org> | 2019-10-20 21:17:11 +0200 |
| commit | ce06805d530f6cb1e65c711dd34d7de9e177b5ac (patch) | |
| tree | 754b7e6f5a6c3817a0dd086e2b22fabfdbdb2e58 /Makefile | |
| parent | 1c472304bce8c9e34fdb53ece890229a0b0201be (diff) | |
update-nvd: Fetch NVD JSON feeds instead of XML feeds
As per October 16, 2019, NVD does not provide anymore the XML data
feeds which the security-tracker uses to fill in long description of a
CVE or determine the external severity.
In update-nvd target switch to fetch the json files from
https://nvd.nist.gov/feeds/json/cve/1.1/$feedname
instead.
Signed-off-by: Salvatore Bonaccorso <carnil@debian.org>
Diffstat (limited to 'Makefile')
| -rw-r--r-- | Makefile | 8 |
1 files changed, 5 insertions, 3 deletions
@@ -112,14 +112,16 @@ update-lists: # Since October 16, 2015 the XML data feeds are no longer available for # download in an uncompressed format. +# As per October 16, 2019, the XML data feeds were discontinued and NVD +# only provides JSON feeds. Cf. https://bugs.debian.org/942670 update-nvd: mkdir -p data/nvd for x in $$(seq 2002 $$(date +%Y)) ; do \ - name=nvdcve-$$x.xml.gz; \ - wget -q -Odata/nvd/$$name https://nvd.nist.gov/download/$$name || true; \ + name=nvdcve-1.1-$$x.json.gz; \ + wget -q -Odata/nvd/$$name https://nvd.nist.gov/feeds/json/cve/1.1/$$name || true; \ gzip -f -d data/nvd/$$name || true; \ done - bin/update-nvd data/nvd/nvdcve-*.xml + bin/update-nvd data/nvd/nvdcve-*.json # Experimental code to compare the Debian and NVD CVE databases using # CPE values as common key. |