Skip to content

feat: add message about mirror when nvd is down #3547

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
terriko opened this issue Nov 29, 2023 · 7 comments · May be fixed by #5023
Open

feat: add message about mirror when nvd is down #3547

terriko opened this issue Nov 29, 2023 · 7 comments · May be fixed by #5023
Assignees
@AryanBakliwal
Milestone
future

Comments

@terriko
Copy link
Contributor

terriko commented Nov 29, 2023 •
edited
Loading

@torabi12 posted a really interesting screenshot of what it looked like when NVD API2 failed while NVD was down:

          I can not update the DB using api2:

image

Originally posted by @torabi12 in #3541 (comment)

We should really make it easier for people to find out that if NVD is down they could fail over to the https://cveb.in mirror. I'd suggest if we have any sort of network failure with NVD that fails completely (e.g. do let it actually retry appropriately before failing over) we should print a big warning message explaining that NVD appears to be down and we're reverting to the mirror, then do that.

We should also update our documentation to make sure we explain how to switch to the mirror if you're having other weirdness with NVD (it happens sometimes, and is likely to happen more as they do some technical changes in December). The answer is you have to remove your NVD_API_KEY from your config/environment/command line flags, and I don't think that's terribly obvious.
@terriko terriko added this to the future milestone Nov 29, 2023
@torabi12
Copy link

Yes, it would be great, because the user does not know what is behind the curtain. :)

@ayushthe1
Copy link
Contributor

hey @terriko , I would like to take on this issue. Could you please guide a bit on how to get started with it.

@terriko
Copy link
Contributor Author

terriko commented Jan 16, 2024

@ayushthe1

A quick way to start:

  • try disconnecting your computer from the network and then running cve-bin-tool -u now and seeing where it fails with a python traceback instead of a nice error message. You probably want to disable all data sources other than NVD so you don't have to wait for every other timeout too.
  • figure out how to catch the NVD related failure and have it switch to the mirror (which will also fail, and may need a nicer error message associated with it)
  • Note that since you're disconnected the mirror will also fail so you might as well make sure that prints an error message instead of a traceback too.

I think it generates a request network timeout error or something similar. Make sure whatever you do doesn't break whatever we have in place to do retries and only happens after we've given up on those. This likely isn't a super easy bug so be prepared for it to be confusing!

We also have a vague intention of standardizing the network libraries we use to all be requests, so if switching to requests right now makes your job easier don't be afraid to go that route.

@inosmeet
Copy link
Contributor

inosmeet commented Feb 4, 2024

Hey @ayushthe1, are you working on this?

@ayushthe1
Copy link
Contributor

Hey @ayushthe1, are you working on this?

Yes @Dev-Voldemort , I'm working. Will open a PR in few days on it. Was busy in my exams, so have been late on it. 😀

@terriko terriko mentioned this issue Feb 7, 2024
Merged
@inosmeet
Copy link
Contributor

any update ??
@ayushthe1

@AryanBakliwal
Copy link
Contributor

@terriko I am taking this issue

@terriko terriko assigned AryanBakliwal and unassigned ayushthe1 Mar 21, 2025
@AryanBakliwal AryanBakliwal linked a pull request Apr 12, 2025 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@AryanBakliwal AryanBakliwal

Labels
None yet
Projects
None yet
Milestone
future
Development

Successfully merging a pull request may close this issue.

feat: add message about mirror when nvd is down AryanBakliwal/cve-bin-tool
5 participants
@terriko @inosmeet @torabi12 @AryanBakliwal @ayushthe1