aueb-balab / vulinoss Goto Github PK

from https://nvd.nist.gov/vuln/Data-Feeds/JSON-feed-changelog:

In CVE_JSON_4.0_min.schema, the affects element has been removed from the required properties.
"required": [ "data_type", "data_format", "data_version", "CVE_data_meta", "affects", > "problemtype", "references", "description" ],

This justify the exception on the first attempt to run:

(vulinoss)  ubuntu@charles-vm:~/git/VulinOSS/vulinoss git:(master) ✗ python nvd_json_parser.py /home/ubuntu/vul-work/nvd-data /home/ubuntu/git/VulinOSS/data/highest_cve_rated_oss.csv -m /home/ubuntu/git/VulinOSS/data/nvd_project_name_mapping.csv
Reading NVD project name mapping file /home/ubuntu/git/VulinOSS/data/nvd_project_name_mapping.csv
        Found 102 mappings
ProjectList object created
Parsing json file :: /home/ubuntu/vul-work/nvd-data/nvdcve-1.1-2011.json
Traceback (most recent call last):
  File "nvd_json_parser.py", line 90, in <module>
    vendors = cve_entry['affects']['vendor']['vendor_data']
KeyError: 'affects'

After running the nvd_json_parser and trying to connect the repositories with the code_metrics_retriever, the version_reference field does not get any values.

Do I miss something?

also its libs forlder

First attempt to run the code, the repo_downloader.sh referenced in the documentation does not exist.

Hello dear Antonis Gkortzis.

First I want to say thanks for this great repo.

But I still have a little thing that confused me. Does the database contain a table or column that refers to the source code that includes some vulnerabilities, rather than the URL of the project?

Have a nice day!

The README.md lacks the details to build all the information to build (or update) the database, from scratch/from dump provided ...