Curious as to why NVD is not used for Analysis for CVEs

[nigellh]

Hi

I can see that DT uses NVD as a local mirror. I am guessing that it is used for enriching CVEs that are returned by another analysis tool.

I can also see that it is a sqlite pretty basic database so very limited for searches.

There appear to be a couple of options:

1. When creating the mirror create a more sophisticated DB that has affected versions from CWEs that could be searched on.
2. Just call for the package against the DB to get all the CVEs for that package and then process which ones actually have a matching version and discard the rest.

The reason for asking is that we have lost Sonatype as a source of vulnerabilities due to its 500/month limit.

The only other 'free one' Is OSV and that sort of sucks as it returns advisories and you have to go into the Aliases to see if there is a CVE.

Trivy is a possibility. I did set up a version, but yet to be proven in accuracy.

I have done the second and it works well. With a mirror the time it takes is negligible. You do need to normalise the versions of the package before comparing them to the affected versions. But so far seems to be working well.