On 3 Mar 2024, at 13:18, Peter Marko via lists.yoctoproject.org <[email protected]> wrote: > > I already mentioned this last week. > https://lists.openembedded.org/g/openembedded-core/message/196199 > > I think that partial NVD DB update is not working properly as things which > were corrected by NVD are still showing up in patchmetrics but not in email > reports.
I need to file a bug for this issue. If CPEs are updated then they only reach an existing database if the CVE itself is updated, as a CPE change alone isn’t enough to appear in the query we use. I’ve a branch that adds this second query to the fetcher but it is incredibly slow (and you thought the current fetcher was slow?) and still isn’t 100% accurate. NIST are aware of “limitations” with the new API… For accurate runs I do sadly recommend forcing a full fetch of the CVE data. Ross
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#196597): https://lists.openembedded.org/g/openembedded-core/message/196597 Mute This Topic: https://lists.openembedded.org/mt/104701002/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
