jeremylong / Open-Vulnerability-Project

Java libraries for working with available vulnerability data sources (GitHub Security Advisories, NVD, EPSS, CISA Known Exploited Vulnerabilities, etc.)
Apache License 2.0
112 stars 34 forks source link

Recoverable I/O exception (org.apache.hc.client5.http.HttpHostConnectException) caught when processing request to {s}->https://services.nvd.nist.gov:443 #122

Closed ggggr closed 7 months ago

ggggr commented 9 months ago

Hi,

I try to use the cli with the following ./vulnz-5.1.1.jar cve --cache --directory ./cache --prettyPrint --debug --delay 100000 --recordsPerPage 1 but I get the following error :

Recoverable I/O exception (org.apache.hc.client5.http.HttpHostConnectException) caught when processing request to {s}->https://services.nvd.nist.gov:

I have try several options without success.

I have curled the url with api key, I have a successfull response

jeremylong commented 9 months ago

I would not set the record per page - you'd be making almost 200,000 individual requests. This should work; but better would be to obtain an NVD API Key as documented.

./vulnz-5.1.1.jar cve --cache --directory ./cache --prettyPrint --debug --delay 10000

The recoverable IO exception can be ignored.

ggggr commented 9 months ago

ok thanks, it was just for testing purpose.

I should miss something as the directory "cache" is still not populated. I still have the error : Retrying request /rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 : x time Thats may be the real issue

Can I increase logging level ?

Ps : curl https://services.nvd.nist.gov/rest/json/cves/2.0?resultsPerPage=2000&startIndex=0 is working

thanks a lot for your help

jeremylong commented 9 months ago

I would suggest obtaining an API Key; see https://github.com/jeremylong/Open-Vulnerability-Project/blob/main/open-vulnerability-clients/README.md#nvd-links

I realize some of this documentation needs to be better organized.

jeremylong commented 9 months ago

running:

export NVD_API_KEY=#####-#####-#####
./vulnz-5.1.1.jar cve --cache --directory ./cache --delay 10000

Should work