VCIO-next: Vulnerability is missing KEV data [was: VCID-3hng-483x-aaar is incomplete]

[DennisClark]

See https://public.vulnerablecode.io/vulnerabilities/VCID-3hng-483x-aaar?search=CVE-2024-39891

Vulnerability VCID-3hng-483x-aaar shows a relationship to CVE-2024-39891 but there are no Packages and there is no KEV reference to the corresponding entry in the Known Exploited Vulnerabilities Catalog. The KEV was published with the title Twilio Authy Information Disclosure Vulnerability on 2024-07-23. See https://www.cisa.gov/known-exploited-vulnerabilities-catalog

A vulnerability without at least one affected package does not make a lot of sense to me in VCIO.

I am also concerned that we are not keeping KEV data up-to-date. See related #1028 and #1422

[ziadhany]

@DennisClark

This vulnerability data is linked to the NVD importer, as indicated in the history tab, so I ran the NVD importer locally and obtained the same result:

Fixed by packages (0) 
Affected packages (0)  

This issue seems to be related to how we import data from the NVD. I find it confusing for a vulnerability to lack at least one affected package, but sometimes the description still makes sense.

The improver ran successfully and fetched the KEV data on my computer, so it’s likely that it hasn’t yet run on the server. When was the last update to the server? I think we should wait to merge some pending pull requests before releasing and updating the server.

[DennisClark]

@ziadhany thanks for investigating this. I agree that "we should wait to merge some pending pull requests before releasing and updating the server."

[DennisClark]

Here is another example: https://public.vulnerablecode.io/vulnerabilities/VCID-aub5-9vuw-aaah?search=CVE-2024-36971

That CVE, CVE-2024-36971 , appears in the KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog but there is no evidence of that in VCIO.

[DennisClark]

Another example: https://public.vulnerablecode.io/vulnerabilities/VCID-rqea-u6nh-aaaj?search=CVE-2024-32113

That CVE, https://nvd.nist.gov/vuln/detail/CVE-2018-0824 appears in the KEV https://www.cisa.gov/known-exploited-vulnerabilities-catalog but there is no evidence of that in VCIO.

[keshav-space]

Related core issue:

• Collect raw data from CISA KEV and other sources and store them in git repo #1643