DependencyCheck: NIST NVD URL no longer works

This looks like a permanent change in their URL scheme. The difference seems to be adding xml schema version in the URL (…xml/cve/2.0/… instead of …xml/cve/…). From a quick visual check here all feed links seem to follow the new scheme.

Anyway, seems we can work around this by configuring the new URL. In a gradle build script this looks like:

dependencyCheck {
     cve {
         url20Modified = 'https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz'
         url20Base = 'https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz'
     }

Documentation: https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration-update.html

v3.1.2 was released today which resolves this issue.

You could find new links at https://nvd.nist.gov/vuln/data-feeds#XML_FEED for configuration change as @zerogvt and @shekh-akther mentioned above. For those who use maven - working config:

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>3.1.1</version>
    <configuration>
        <cveUrl12Modified>https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-modified.xml.gz</cveUrl12Modified>
        <cveUrl20Modified>https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz</cveUrl20Modified>
        <cveUrl12Base>https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-%d.xml.gz</cveUrl12Base>
        <cveUrl20Base>https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz</cveUrl20Base>
    </configuration>
</plugin>

These cli parameters work for me:

owasp-dependency-check --data mydatadir --project myprojectname -o reports -f JSON -s . -l logfile --cveUrl12Base "https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-%d.xml.gz" --cveUrl20Base "https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-%d.xml.gz" --cveUrl12Modified "https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-modified.xml.gz" --cveUrl20Modified "https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz"

NIST’s XML feed overview page actually lists the new URLs, so DependencyCheck should react immediately and fix this breakage in a new release.

@if08017 same recommendation as the Jenkins folks. Specify NVD URLs typically used for mirroring. You wont actually be using a NVD mirror (although I do recommend it), you’ll simply be correcting the URLs using this method.

Refer to https://jeremylong.github.io/DependencyCheck/dependency-check-cli/arguments.html

• cveUrl12Modified
• cveUrl20Modified
• cveUrl12Base
• cveUrl20Base

Until a newer version is available, you can update Jenkins settings to reflect these URLs:

https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-modified.xml.gz https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-modified.xml.gz https://nvd.nist.gov/feeds/xml/cve/1.2/nvdcve-2018.xml.gz https://nvd.nist.gov/feeds/xml/cve/2.0/nvdcve-2.0-2018.xml.gz

Hope this helps. I was able to test it on owasp dependency plugin 3.1.1 and 2.1.0

For maven users: please follow Example 5 from documentation: https://jeremylong.github.io/DependencyCheck/dependency-check-maven/index.html

I see that the old URL (https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml.gz) is now working again (together with the new URL). Any information about this decision?

@kalyankix - thanks a lot for providing directly the links - worked as a charm for me on my Jenkins!

Any help for cli users? I found the same issue,

Hopefully, this is a temporary configuration issue on their end as it effects the entire Dependency-Check ecosystem. But the URL endpoints have changed. For those who are using nist-data-mirror, it’s been updated with the new URLs and a release pushed to Maven Central. Awaiting synchronization.