CVE scanner depends on deprecated CVE data feeds

envoyproxy / envoy

Cloud-native high-performance edge/middle/service proxy

https://www.envoyproxy.io

Apache License 2.0

24.82k stars 4.77k forks source link

CVE scanner depends on deprecated CVE data feeds #25680

Open phlax opened 1 year ago

phlax commented 1 year ago

Currently we download the vulnerability data feeds from NIST

These data feeds are set to be removed in september 2023 (https://nvd.nist.gov/vuln/data-feeds)

The suggested fix is to move to querying APIs

The current way is v expensive resource-wise so moving to APIs is a good idea anyway, but looks like this now has some urgency

phlax commented 1 year ago

cc @htuch @moderation

github-actions[bot] commented 1 year ago

This issue has been automatically marked as stale because it has not had activity in the last 30 days. It will be closed in the next 7 days unless it is tagged "help wanted" or "no stalebot" or other activity occurs. Thank you for your contributions.

phlax commented 1 year ago

fixing this will possibly resolve the intermittent issues we have getting data from NIST (cf #26389)