"Exception while parsing NVD CVE feed" when no vulnerability found about dep-scan HOT 5 CLOSED

Yeah, failing for me as well. Investigating ...

from dep-scan.

Thanks for reporting this issue.

Just one bad CPE value in the NVD database broke depscan!

cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\::*:*:*:*:*:*:*:*

In the above value, not only there is a problematic backslash, the version part following the string communications_diameter_signaling_router_idih is empty instead of *. We know the quality of NVD is often lacking but this is unexpected.

I have added some workarounds to guard against this here:

AppThreat/vulnerability-db@f73308f

scan image is rebuilt to include this fix now.

from dep-scan.

@prabhu Very thanks for your quick fixing on this issue, I'm using "appthreat/dep-scan:latest", it failed again. I'm not very familiar with this, it there anything need to be updated on "appthreat/dep-scan:latest"?

from dep-scan.

@jerryline Are you able to use the parent project called slscan?

https://slscan.io/en/latest/

-t depscan would invoke depscan. I will see if I can update this particular image separately.

from dep-scan.

There was a bug in the dockerfile so recent "appthreat/dep-scan" docker builds were failing. This is now resolved and the latest image has got built successfully. But would highly recommend moving to slscan since it has got a bit more rich feature set and scanning tools.

from dep-scan.