Required to use own local repo as NVD db but --nvdApiEndpoint arguments not working

[tanmoyrsc]

Hi,

I want to replace "https://services.nvd.nist.gov/rest/json/cves/2.0" url with my local NVD location but found --nvdApiEndpoint parameter is not working. I even try to build the project with my url instead of nvd url bit it didn't worked.

please help to resolve the issue.

Br,
Tanmoy

[jeremylong]

You likely want to use the data feed argument:

--nvdDatafeed "http://your.local/nvd"

Assuming you are using the vulnz CLI to create the NVD cache.

[tanmoyrsc]

Hi,

I am able to download the cache now, now requirement is to upload the cache to local Jfrog repo and for that I need to map docker container volume to local volume but for the URL "ghcr.io/jeremylong/vulnz:6.1.7" getting is not exists error. can you please help in this.

Br,
Tanmoy

[aikebah]

@tanmoyrsc If you manage to download the cache already, why would you need the vulnz docker container? That is just a packaging of the same vulnz cli and a http-server meant to act as a server of the mirrored cache (https://github.com/jeremylong/Open-Vulnerability-Project/blob/main/vulnz/Dockerfile).

Since you apparently want to host the cache on JFrog you would only need the vulnz CLI to build the caches and then manually publish them in your JFrog.

Putting all that aside: the not exists error is because (not all) the documentation on the Open-Vulnerability-Project README is in-sync with the published container image in Github Packages.

As you can find on the Open-Vulnerability-Project in the sidebar under Packages the proper location for the current published docker image for that project is ghcr.io/jeremylong/open-vulnerability-data-mirror:v6.1.7.

Had you picked one of the entries specifying jeremylong/open-vulnerability-data-mirror:v6.1.7 from the same README you would've likely succeeded.

Had you picked the option to build the container yourself with the instructions in the README the tag you used would've worked as that instruction instructs you to tag the image with those coordinates.