On Mon, Mar 4, 2024 at 1:29 PM Ross Burton <[email protected]> wrote: > > On 3 Mar 2024, at 13:18, Peter Marko via lists.yoctoproject.org > <[email protected]> wrote: > > > > I already mentioned this last week. > > https://lists.openembedded.org/g/openembedded-core/message/196199 > > > > I think that partial NVD DB update is not working properly as things which > > were corrected by NVD are still showing up in patchmetrics but not in email > > reports. > > I need to file a bug for this issue. If CPEs are updated then they only > reach an existing database if the CVE itself is updated, as a CPE change > alone isn’t enough to appear in the query we use. > > I’ve a branch that adds this second query to the fetcher but it is incredibly > slow (and you thought the current fetcher was slow?) and still isn’t 100% > accurate. NIST are aware of “limitations” with the new API… > > For accurate runs I do sadly recommend forcing a full fetch of the CVE data. >
I second Ross that we're likely hitting that problem. We have discussed that with Ross before and there seems to be no workaround other than to download the whole database. Solutions I see: - always fetch the whole database - go back to the old legacy system with JSON dumps (which is still online) - have an "official" YP mirror of the database Probably a subject we could discuss at the today's call. Kind regards, Marta
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#196632): https://lists.openembedded.org/g/openembedded-core/message/196632 Mute This Topic: https://lists.openembedded.org/mt/104701002/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
