September 2023 Retirement of NIST vuln data feeds #poky

September 2023 Retirement of NIST vuln data feeds #poky

[drew.thompson]

[-- Attachment #1: Type: text/plain, Size: 648 bytes --]

Hi All,

I'm looking for where work is being done to ready meta ( https://git.yoctoproject.org/poky/tree/meta?h=master-next ) / recipes-core ( https://git.yoctoproject.org/poky/tree/meta/recipes-core?h=master-next ) / meta ( https://git.yoctoproject.org/poky/tree/meta/recipes-core/meta?h=master-next ) / cve-update-db-native.bb ( https://git.yoctoproject.org/poky/tree/meta/recipes-core/meta/cve-update-db-native.bb?h=master-next ) for the retirement of the JSON data feeds ( https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1- ) and its replacement with https://services.nvd.nist.gov/rest/json/cves/2.0

https://nvd.nist.gov/vuln/data-feeds

[-- Attachment #2: Type: text/html, Size: 1880 bytes --]

Re: [poky] September 2023 Retirement of NIST vuln data feeds #poky

[Richard Purdie]

On Fri, 2023-02-03 at 07:01 -0800, drew.thompson via lists.yoctoproject.org wrote:
> Hi All, 
> 
> I'm looking for where work is being done to ready meta/recipes-
> core/meta/cve-update-db-native.bb for the retirement of the JSON data
> feeds (https://nvd.nist.gov/feeds/json/cve/1.1/nvdcve-1.1-) and its
> replacement with https://services.nvd.nist.gov/rest/json/cves/2.0
> https://nvd.nist.gov/vuln/data-feeds

We're aware of it and I think Ross Burton did have a look but we've not
had any patches yet (which would go to the openembedded-core mailing
list).

I think there is an open bugzilla entry too, perhaps this one is
related:
https://bugzilla.yoctoproject.org/show_bug.cgi?id=14745

Cheers,

Richard